What Gridinsoft observed on I4us.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260821231031-e734e75f
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current first-party review supports Safe for the reviewed i4us.com root deployment. A real phishing page was publicly recorded on the host in 2021, but its exact short URL and hosted resources no longer reproduce that behavior, and the fresh Gridinsoft report provides no current first-party object supporting the broad Suspicious Website signature. Current external blacklist labels are retained only as separately controlled historical reputation context.
Analyst findings
Review 9 documented observations View evidence
A fresh Gridinsoft rescan retained the stored Suspicious Website signature, but its current raw report contained no positive first-party signal and named no exact malicious URL, file, payload, hash, credential receiver, or harmful redirect.
- Analyst observation The fresh raw report recorded positive_signals as an empty list.
- Analyst observation The active signature was a broad i4us.com domain entry rather than an exact current malicious object.
The root returned the expected I4US technology-services website. Five repeated requests reached the same HTTPS root and returned byte-identical content without a changing or unrelated destination.
-
HTTP status
200 -
Final URL
https://i4us.com/ - File SHA-256 1bf9946752ad02d3fc5c4a70d4094a4be9eeb3d41e7dcad160cc09574e786792
- Analyst observation All five reviewed root responses had the same 19893-byte body and SHA-256 value.
All 61 sitemap-listed pages returned HTTP 200 at same-site HTTPS destinations. Their reviewed HTML contained no meta refresh, iframe, password field, executable or archive link, or external form action.
- Analyst observation pages=61; meta_refresh=0; iframes=0; password_fields=0; executable_archive_links=0; external_form_actions=0
-
Final URL
https://i4us.com/
The current root resource graph used same-site application assets plus Google Analytics, Google Tag Manager, and Fontshare. The public intake flow posts to a same-origin endpoint; no form or task was submitted during this review.
- Analyst observation Observed external resource hosts were www.googletagmanager.com, www.google-analytics.com, api.fontshare.com, and cdn.fontshare.com.
- Page element /api/intake
A public urlscan record from 2021 documents a real historical phishing page: the submitted short URL redirected to i4us.com, the page loaded a Monte dei Paschi logo from the host, and urlscan identified Banca Monte dei Paschi as the targeted brand.
- Public artifact URL https://urlscan.io/result/35df97d5-236c-4e62-b684-e131d9df6643/
-
Redirect destination
https://i4us.com/ - Page element /asset/montedeipaschi_logo_hd.png
- Analyst observation This is historical evidence of a phishing page, not a current malicious payload or current domain-wide behavior.
The exact historical script and brand-asset paths reviewed today no longer returned their 2021 resources. Each path returned the same current 19893-byte I4US application shell as the root, with no credential page, executable content, or unrelated redirect.
-
HTTP status
200 - MIME type text/html; charset=UTF-8
- File SHA-256 1bf9946752ad02d3fc5c4a70d4094a4be9eeb3d41e7dcad160cc09574e786792
- Analyst observation Reviewed the four legacy PHP script paths and the six same-origin asset paths recorded by the public 2021 sandbox.
The historical short URL now redirects directly to the current I4US HTTPS root. The reviewed chain did not reproduce the historical bank page or a changing destination.
-
Redirect destination
https://i4us.com/ -
HTTP status
200
The root resolved consistently to its current server, redirected HTTP to the same HTTPS host, and presented a valid certificate for i4us.com and www.i4us.com with HSTS enabled.
- DNS fact i4us.com A 209.74.72.26
- Certificate fact Certificate names include i4us.com and www.i4us.com.
-
Redirect destination
https://i4us.com/
The parent namespace contains separately deployed service and customer-project subdomains. Public certificate names and live homepages were sampled and no wildcard DNS response was present, but the Safe verdict is limited to the reviewed root deployment and exact legacy objects rather than certifying every delegated subdomain or future tenant object.
- Analyst observation Public certificate records exposed 19 hostnames; live sampled hosts presented separate project, administration, or API content.
- Analyst observation Two randomly generated review hostnames returned no DNS record.
Scope and limitations
- The Safe verdict applies to the current public i4us.com root deployment, its sitemap-listed pages, and the exact historical phishing objects rechecked at the recorded time; it is not a certification of every delegated subdomain or future tenant object.
- No contact, intake, payment, AI-agent task, account, or administration form was submitted, and no authenticated or private endpoint was reviewed.
- The review was not a penetration test and did not inspect the private hosting filesystem, server-side code, logs, scheduled jobs, databases, or private third-party consoles.
- Public threat-intelligence sources with authentication-only query APIs could not be independently queried; available public search results and unauthenticated feeds were used only as external context.
Help protect others by sharing this page on social media! The more people who know about i4us.com, the fewer chances they have to deceive someone else. Help others evaluate i4us.com by sharing this page on social media!