norve-ex.icu
Appeared in the .icu zone on Monday, August 31, 2026; by the end of that day the census found active website about crypto web3. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Brand-new .icu domain hosting an anonymous crypto→RUB 'exchanger' (Norve) with no company registration, licensing or contact details, whose entire flow is a form capturing a Telegram handle and then 'an operator will give you the wallet details' — the standard shape of an unlicensed/exit-scam obmennik where the victim sends crypto first; the Telegram mention is the operator channel, not impersonation of Telegram.
The site is a cryptocurrency-to-rubles exchange claiming the 'Norve' brand, operating a sealed-room form (posts to self, no offsite links) that harvests Telegram usernames and collects cryptocurrency details. While it does not impersonate an existing organisation, the structure (form requesting crypto amounts, destination payment method, and Telegram contact without legitimate registration or verification) matches a P2P fraud pattern where collected details are used to conduct unauthorised trans
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Monday, August 31, 2026
Same data as JSON: /api/zone/domain/norve-ex.icu. This page is not indexed by search engines and does not link to the site it describes.