4000[.]top

Analysis of the domain 4000.top, observed as offline on 23 July 2026, indicates a high‑confidence generic phishing threat. The site was registered on 13 November 2024 through PublicDomainRegistry.com (operated by PDR Ltd.) and uses the authoritative name servers ns1.dnsip.com and ns2.dnsip.com. DNS resolution points to IP address 23.248.224.154, which belongs to AS138415 Yancy Limited and is geolocated in Hong Kong. No TLS certificate is presented, meaning all traffic would be unencrypted HTTP. The sole page title retrieved is the Chinese word “欢迎”, providing no indication of the intended victim profile.

Reputation services assign extremely low trust scores: Gridinsoft rates the domain 1 / 100, and Scamadviser also reports a 1 / 100 score. The domain appears on at least one public blocklist and is actively blocked by the PhishDestroy service. AlienVault OTX references the domain in two separate threat‑intel pulses, reinforcing its malicious classification. VirusTotal scans have flagged the domain in 17 of 95 security engines, demonstrating consistent detection across multiple vendors. The evidence base confirms that the infrastructure is deliberately sparse: the registrar offers minimal verification, the hosting IP is shared with other malicious actors, and the lack of SSL suggests a quick‑deployment campaign.

What remains uncertain is the specific phishing lure employed, the exact target audience, and whether additional payloads or redirect chains exist, as no further page content has been captured. Defenders should immediately add 4000.top to DNS‑ and URL‑filtering policies, enforce blocking of the associated IP 23.248.224.154, and monitor for any new resolution records. Continuous re‑scanning of the domain and its IP is advised, as the offline status may change. Organizations using threat‑intel feeds should also incorporate the two OTX pulse identifiers and the PhishDestroy blocklist entry to ensure rapid detection of any resurgence.