Highscore 54 · flagged Thursday, September 10, 2026

dagmail.org

Appeared in the .org zone on Thursday, September 10, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: gmail
+30
form on a brand-styled page
matched: has_form
+18
form submits over plain HTTP
matched: http://dagmail.org/
+6
Registrar
Nameserver provider
Nameservers
a12.share-dns.com, b12.share-dns.net
First-day state
active website
HTTP status
200
Page title
WinWebMail邮件系统
Has a form
yes
Brand echoed
gmail

Model opinions

Second opinionlooks benignconfidence 72%· claude-opus-5

The page is a stock WinWebMail Server webmail login (Chinese self-hosted mail software) on IIS, linking to the vendor winwebmail.com; the 'gmail' hit is only a substring artifact of 'dag'+'mail' and nothing on the page imitates Google/Gmail branding.

First passlooks like phishingtarget: Gmailconfidence 92%· claude-haiku-4-5

Domain name 'dagmail.org' is a typosquat of Gmail, and the page presents a login form (username/password) posting to itself over HTTP with hidden fields, mimicking Gmail's authentication interface. The sealed-room form architecture with no legitimate redirect, combined with the Gmail-derivative domain name, is classic phishing infrastructure designed to capture credentials.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, September 10, 2026

Screenshot of dagmail.org taken by the zone census on 2026-09-10

Same data as JSON: /api/zone/domain/dagmail.org. This page is not indexed by search engines and does not link to the site it describes.