antivirus-mobile.online
Appeared in the .online zone on Sunday, September 20, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The name 'antivirus-mobile.online' exists only to funnel visitors to turboclean.space, a Russian-language page pushing a direct APK sideload ('Cleaner & Antivirus Pro', QR code, 'Скачать APK напрямую', fake 'VirusTotal 0/64 Clean' and Google Play ratings) — the classic Android fake-antivirus/cleaner malware delivery shape, with a throwaway Cloudflare-fronted REG.RU redirector as the lure name. The scorer's 'mobile≈tmobile' typo signal is spurious; this is malware distribution, not brand imperson
The domain 'antivirus-mobile.online' is a brand-typosquat (mobile ≈ T-Mobile) that redirects to an unrelated APK distribution site (turboclean.space). The typosquat name combined with the redirect-to-offsite pattern is a classic brand-squat abuse tactic designed to capture traffic intended for a legitimate brand and redirect it elsewhere, though the destination itself appears to be a generic (if dubious) APK cleaner app rather than a direct phishing impersonation.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Sunday, September 20, 2026
Same data as JSON: /api/zone/domain/antivirus-mobile.online. This page is not indexed by search engines and does not link to the site it describes.