ki-1[.]top

Analysis of the domain ki-1.top shows a pattern consistent with malicious phishing infrastructure. The domain was registered on May 14, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and is served by the nameservers ns1.regery.net, ns2.regery.net, and ns3.regery.net. It resolves to the IP address 45.135.237.15, which belongs to AS153656 OWGELS INTERNATIONAL CO., LIMITED and is geolocated in Hong Kong. No TLS certificate is present, indicating that the site does not offer encrypted HTTPS connections, a common trait of low‑effort phishing sites.

The domain has been flagged by multiple security services: PhishDestroy has already taken it offline, VirusTotal reports that 13 of 95 scanned vendors identified it as malicious, and AlienVault OTX includes it in 17 separate threat‑intelligence pulses. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public blocklist. These indicators collectively confirm that ki-1.top has been used for phishing‑related activity, even though the site is currently inaccessible.

Uncertainty remains around the exact content that was hosted, as no page title or brand targeting information is available. Defenders should continue to block the domain and its resolving IP at network perimeters, add the IP to reputation‑based deny lists, and monitor the registrar for any re‑registration attempts. Continuous observation of threat‑intel feeds for new OTX pulses or additional vendor detections is recommended to capture any resurgence of the infrastructure.