ncis-service.app
Appeared in the .app zone on Friday, October 16, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain redirects to a genuine Cloudflare Access gate (ncis-pers.cloudflareaccess.com) branded for NCIS Group Pty Ltd, with support at ncisgroup.com.au. The email-OTP form posts to Cloudflare's own Access infrastructure, so no credentials reach a third party. This looks like an organisation protecting its own internal app, not impersonation.
The domain ncis-service.app redirects to a Cloudflare Access login page that impersonates NCIS (displaying the NCIS logo and 'Secure Access' branding) and solicits email credentials with a 'Send login code' button. The support email (pers.support@ncisgroup.com.au) reinforces the false identity. The form posts to ncis-pers.cloudflareaccess.com with email, client_id, connector_id, and connector_type fields—a credential-capture setup masquerading as legitimate Cloudflare Access infrastructure. The
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, October 16, 2026
Same data as JSON: /api/zone/domain/ncis-service.app. This page is not indexed by search engines and does not link to the site it describes.