bahis-adres26.icu
Appeared in the .icu zone on Tuesday, September 1, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Name is Turkish for 'betting address' with a sequential counter (bahis-adres26.icu), the standard shape of an unlicensed-gambling mirror/redirector campaign that rotates numbered .icu domains behind Cloudflare; it currently parks on dns.google as a holding target, which is not impersonation of Google but a placeholder while the betting redirect is staged.
Domain 'bahis-adres26.icu' (Turkish for 'betting-address') redirects to dns.google to serve a cloned Google Public DNS login page. The attacker owns the domain and controls the redirect to present Google's branding and form as if it were their own site, deceiving visitors into entering credentials on a domain they control. The 'bahis' prefix and .icu TLD indicate gambling-related abuse infrastructure repurposed for credential phishing.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Tuesday, September 1, 2026
Same data as JSON: /api/zone/domain/bahis-adres26.icu. This page is not indexed by search engines and does not link to the site it describes.