id-gkf9htj3gh.rest
Appeared in the .rest zone on Thursday, November 12, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain serves no content of its own and redirects to the real www.google.com, so the Google branding and form are not impersonation. The throwaway random name ('id-' plus a random string) on a .rest TLD behind Cloudflare, redirecting to Google, fits phishing-kit cloaking that sends scanners away, but no deceptive page has been observed yet.
The domain id-gkf9htj3gh.rest uses an obfuscated name with 'id-' prefix and random characters, then silently redirects to www.google.com. This is a classic phishing redirect tactic: the attacker controls the domain but serves Google's legitimate page, making it invisible to the visitor that they have been redirected through a malicious intermediary. The domain name itself (meaningless alphanumeric string on a suspicious TLD) reveals deceptive intent; legitimate redirects use transparent domain n
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Thursday, November 12, 2026
Same data as JSON: /api/zone/domain/id-gkf9htj3gh.rest. This page is not indexed by search engines and does not link to the site it describes.