domoreoyunitemiy.icu
Appeared in the .icu zone on Thursday, October 29, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
A throwaway-looking .icu name behind Cloudflare (the 'oyun' fragment is Turkish for 'game', a common betting-domain pattern) redirects to the unrelated news site qz.com. This fits a cloaking setup that shows scanners a benign site, but nothing malicious is served yet. The forms are qz.com's own newsletter sign-ups, and the 'google' brand hit is spurious, so there is no impersonation.
The domain domoreoyunitemiy.icu is a brand-squat redirect to qz.com's legitimate site. The domain name itself has no legitimate purpose—it is an arbitrary string with no connection to any brand or business—and its sole function is to redirect to Quartz's real domain. This is a typosquat/redirect abuse pattern: the attacker registered a throwaway domain to funnel traffic to a legitimate site, likely for affiliate commission, SEO manipulation, or ad injection. The presence of forms on the redirect
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Thursday, October 29, 2026
Same data as JSON: /api/zone/domain/domoreoyunitemiy.icu. This page is not indexed by search engines and does not link to the site it describes.