i4-app[.]top

Analysis of i4-app.top shows multiple independent indicators that the domain is being used for malicious activity. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the IPv4 address 172.245.67.31, which is hosted by AS36352 (HostPapa) in the United States. DNS resolution uses the shared nameservers a3.share-dns.com. and b3.share-dns.net., a pattern commonly observed in transient phishing infrastructure. The TLS certificate presented on the host resolves to IP 172.245.67.50, a mismatch that is often associated with domain‑fronting or poorly configured phishing sites.

Google Safe Browsing has flagged the domain for unwanted software, and VirusTotal records show that 10 of 93 scanned security vendors have flagged i4-app.top as malicious, reinforcing the suspicion of malicious intent. AlienVault OTX lists the domain in one threat‑intelligence pulse, and PhishDestroy has actively blocked the host. The site appears on at least one public blocklist, indicating that external security services have incorporated the domain into their defense feeds.

The only visible content attribute is the page title "DeepL," which suggests an attempt to reference a legitimate translation service, but no further site content has been publicly analysed. Because the domain is currently offline, live verification of the payload is not possible, yet the aggregated evidence from registration, hosting, SSL, and multiple reputation feeds provides a high‑confidence indication of a phishing operation. Defenders should add i4-app.top to URL filtering, sink‑hole, and endpoint blocklists, monitor for any reappearance of the domain or its associated IP range, and consider tightening email gateway rules for messages that reference DeepL or related keywords. Continuous observation of the hosting provider's IP space is advised, as similar phishing campaigns often recycle the same infrastructure.