mail-accounts-googlesignin-bidding-newproposal.icu
Appeared in the .icu zone on Friday, October 2, 2026; by the end of that day the census found boilerplate page. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The name 'mail-accounts-googlesignin-bidding-newproposal' pairs Google sign-in and account wording with a 'bidding/new proposal' document lure, a classic credential-phish shape, on a cheap .icu TLD behind Cloudflare. It currently bounces scanners through the href.li anonymiser to example.com, which looks like cloaking rather than a real destination.
The domain name is a clear typosquat combining Google brand signals with account/signin lures (mail-accounts-googlesignin-bidding-newproposal.icu), but it does not impersonate Google on its own page—it redirects to a generic URL shortener (href.li). This is a brand-squat redirect domain: the deceptive value lies in the name itself luring victims, not in page content impersonation. The .icu TLD, Cloudflare nameservers, and Dynadot registrar are typical of mass-abuse infrastructure.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, October 2, 2026
Same data as JSON: /api/zone/domain/mail-accounts-googlesignin-bidding-newproposal.icu. This page is not indexed by search engines and does not link to the site it describes.