ref404.lol
Appeared in the .lol zone on Monday, October 26, 2026; by the end of that day the census found active website. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page presents its own brand (ref404) as a third-party Telegram bot that notifies users of DHL/UPS tracking changes. It has no DHL logo or portal styling, no form, and no request for credentials or payment, and it includes a privacy-policy and contact section. DHL is named only as a supported carrier, Telegram is the delivery platform, and the throwaway .lol name and Russian menu label are minor oddities rather than signs of deception.
The domain ref404.lol is a legitimate Telegram bot service for parcel tracking that mentions DHL and UPS as carriers it integrates with, not impersonation of those brands. The page clearly presents its own brand (ref404), explains its functionality (automated tracking notifications via Telegram), provides contact information, and directs users to a Telegram bot—no credentials, payment form, or personal data capture attempt is present.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Monday, October 26, 2026
Same data as JSON: /api/zone/domain/ref404.lol. This page is not indexed by search engines and does not link to the site it describes.