Highscore 55 · flagged Saturday, September 19, 2026

intuit-support.email

Appeared in the .email zone on Saturday, September 19, 2026; by the end of that day the census found redirects elsewhere. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: intuit
+30
lure words (login, verify, secure…)
matched: support
+26
brand name at a retail registrar
matched: Hosting Concepts B.V. d/b/a Registrar.eu
+8
brand name and brand-styled page
matched: intuit
+15
Registrar
Hosting Concepts B.V. d/b/a Registrar.eu
Nameserver provider
Nameservers
ns1.openprovider.nl, ns2.openprovider.be, ns3.openprovider.eu
First-day state
redirects elsewhere
HTTP status
200
Page title
Intuit®: Outdo your financial goals—all in one place
Has a form
no
Brand echoed
intuit

Model opinions

Second opinionlooks like abusetarget: Intuitconfidence 72%· claude-opus-5

intuit-support.email is a brand-squat combining Intuit's exact trademark with a 'support' lure on the .email TLD, registered through a retail registrar (Hosting Concepts/Registrar.eu) rather than Intuit's corporate brand-protection registrar, and it serves no content of its own — only a cloaking redirect to the real www.intuit.com, a common cover for a domain whose actual purpose is sending fake Intuit/QuickBooks/TurboTax support mail.

First passlooks like phishingtarget: Intuitconfidence 92%· claude-haiku-4-5

Domain intuit-support.email impersonates Intuit by using the brand name and 'support' lure word, then redirects to Intuit's legitimate site. This is a classic typosquat/redirect phishing setup: the attacker controls a deceptive domain that will capture traffic from users seeking Intuit support, harvest their trust via the brand name, and either intercept credentials during the redirect chain or use the domain for email-based credential phishing (the .email TLD is a strong signal). The nameserver

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Saturday, September 19, 2026

Screenshot of intuit-support.email taken by the zone census on 2026-09-19

Same data as JSON: /api/zone/domain/intuit-support.email. This page is not indexed by search engines and does not link to the site it describes.