n6sf9m.sbs
Appeared in the .sbs zone on Thursday, August 27, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain does not host any content of its own — it redirects offsite to the genuine http://www.google.com (server 'gws'), so the 'Google' title and sign-in/search form are Google's real page, not an impersonation. A random-string name on the abuse-heavy .sbs TLD behind Cloudflare NS that currently bounces to google.com is a typical cloaking/parking posture for a campaign not yet activated, but there is no deceptive content to judge yet.
The domain redirects to http://www.google.com (Google's legitimate homepage), and the page content is Google's actual search interface served from Google's own server (gws). This is a redirect, not an impersonation attempt; the attacker has no control over the destination page or its credential capture.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Thursday, August 27, 2026
Same data as JSON: /api/zone/domain/n6sf9m.sbs. This page is not indexed by search engines and does not link to the site it describes.