Highscore 55 · flagged Thursday, September 10, 2026

google1.app

Appeared in the .app zone on Thursday, September 10, 2026; by the end of that day the census found server error. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: google
+30
brand plus digits
matched: google1
+8
free DNS provider
matched: dnsowl.com
+8
brand name at a retail registrar
matched: NameSilo, LLC
+8
brand name at a watch-list registrar
matched: NameSilo, LLC
+6
Registrar
NameSilo, LLC
Nameserver provider
Nameservers
ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com
First-day state
server error
HTTP status
521
Page title
google1.app | 521: Web server is down
Has a form
no
Brand echoed
google

Model opinions

Second opinionlooks like abusetarget: Googleconfidence 75%· claude-opus-5

google1.app is a brand+digit squat on Google registered through a retail registrar (NameSilo) with free DNS (dnsowl), not by Google itself despite Google operating the .app registry; the site serves only a Cloudflare 521 error with no content, so it is a brand-squat with no legitimate purpose rather than an active phish yet.

First passsuspicioustarget: Googleconfidence 72%· claude-haiku-4-5

Domain google1.app uses a brand typosquat name with a digit appended to Google; currently shows a Cloudflare 521 error page (hosting-provider placeholder) with no active phishing content, but the combination of typosquat name, free DNS service (dnsowl.com), and use of retail registrar NameSilo suggests preparatory setup for potential abuse. The error page itself is legitimate Cloudflare infrastructure, not impersonation.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, September 10, 2026

Screenshot of google1.app taken by the zone census on 2026-09-10

Same data as JSON: /api/zone/domain/google1.app. This page is not indexed by search engines and does not link to the site it describes.