deepseek-v4[.]lol

PhishDestroy has identified the domain deepseek-v4.lol as a generic phishing site that impersonates the DeepSeek AI brand, specifically targeting users with a fake DeepSeek V4 model overview page. The domain is currently offline, but during its active period it mimicked legitimate DeepSeek materials to deceive visitors. The threat type is credential theft, as the page likely aimed to harvest login credentials or personal information under the guise of a new AI model release.

Technical analysis reveals that deepseek-v4.lol was flagged by 4 of 95 VirusTotal security vendors, indicating moderate but notable detection among the cybersecurity community. The domain was registered through Porkbun, LLC on April 26, 2026, and resolves to the IP address 144.91.73.228. It appears on three security blocklists and is associated with one threat intelligence pulse on AlienVault OTX. The SSL certificate was issued by Let's Encrypt (R13), which is commonly abused by phishing operations due to its free and automated issuance. The page title, "DeepSeek V4 | 1M Context Model Overview, Modes, and Public References," was designed to appear legitimate and capitalize on interest in advanced AI models.

As the domain is now offline, the immediate risk is mitigated, but users should remain vigilant against similar fraudulent domains. PhishDestroy recommends verifying any DeepSeek-related communications or updates through official channels only, and avoiding clicking on links from unsolicited sources. If credentials were inadvertently entered on this site, they should be changed immediately and accounts monitored for unusual activity. Blocklist inclusion and vendor flags indicate that security tools have recognized this threat, but user awareness remains a critical defense layer.