Highscore 44 · flagged Tuesday, September 15, 2026

letuspickwinner.shop

Appeared in the .shop zone on Tuesday, September 15, 2026; by the end of that day the census found redirects elsewhere. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

lure words (login, verify, secure…)
matched: winner
+6
brand in page title, not in the name
matched: google
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Nameserver provider
Nameservers
dns1.regway.com, dns2.regway.com, dns3.regway.com, dns4.regway.com
First-day state
redirects elsewhere
HTTP status
200
Page title
Google
Has a form
yes
Brand echoed

Model opinions

Second opinionsuspiciousconfidence 62%· claude-opus-5

The domain serves no content of its own — it redirects to www.google.com, a common cloaking/holding tactic for a campaign not yet live, so all Google branding in the evidence belongs to the destination and is not impersonation by this domain. The name itself ("letuspickwinner") is prize/sweepstakes lure language on a cheap .shop TLD with reseller nameservers, which is suggestive of a future giveaway scam but not yet decisive evidence of abuse.

First passlooks like abuseconfidence 95%· claude-haiku-4-5

The domain name 'letuspickwinner.shop' is a typosquat/brand-squat with 'winner' lure words and '.shop' TLD designed to deceive, redirecting to Google's legitimate homepage. The redirect itself is not phishing (it goes to real Google, not a fake login), but the domain's sole purpose—a deceptive name that tricks users into clicking it expecting a prize/gambling outcome—is a classic abuse squat. The nameservers (regway.com) and redirect infrastructure indicate opportunistic abuse rather than a legi

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, September 15, 2026

Screenshot of letuspickwinner.shop taken by the zone census on 2026-09-15

Same data as JSON: /api/zone/domain/letuspickwinner.shop. This page is not indexed by search engines and does not link to the site it describes.