Criticalscore 60 · flagged Monday, September 14, 2026

galaxus.icu

Appeared in the .icu zone on Monday, September 14, 2026; by the end of that day the census found active website about e-commerce & retail. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: icu
+8
page pushes urgent payment
matched: LIMITED TIME OFFER
+14
brand in page title, not in the name
matched: wordpress
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Nameserver provider
Nameservers
lunar.dns-parking.com, solar.dns-parking.com
First-day state
active website
HTTP status
200
Page title
Good – The High Converting eCommerce WordPress Theme
Has a form
yes
Brand echoed

Model opinions

Second opinionlooks like a scamconfidence 72%· claude-opus-5

Unfinished WooCommerce dropship template (title still the theme demo 'Good – The High Converting eCommerce WordPress Theme', demo imports from thememove.com) branded 'GALAXUS' on a .icu domain, selling random 70–88%-off junk with 'LIMITED TIME OFFER' urgency — the classic fake-shop shape that takes card payment for goods it will not ship; it borrows the Swiss retailer Galaxus's name but does not replicate its site, so it reads as a fraudulent store rather than credential phishing.

First passlooks like abuseconfidence 85%· claude-haiku-4-5

The domain galaxus.icu uses a .icu TLD (typically associated with abuse) and displays a generic WordPress eCommerce template filled with unrelated dropshipped products (bras, toys, LED cases, furniture) under the 'GALAXUS' brand name. The page has a password form posting to itself (sealed-room phish shape), but there is no impersonation of a specific target organisation—this appears to be a typosquat or brand-squat of the legitimate Swiss retailer Galaxus, repurposed as a dropshipping fraud fron

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, September 14, 2026

Screenshot of galaxus.icu taken by the zone census on 2026-09-14

Same data as JSON: /api/zone/domain/galaxus.icu. This page is not indexed by search engines and does not link to the site it describes.