venomworksentertainment.icu
Appeared in the .icu zone on Thursday, September 10, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain simply 302s to the genuine www.facebook.com login/next URL for a specific Facebook profile (Venomoussmoke444@gmail.com), i.e. an owner pointing a business name at their own Facebook page; the credential form belongs to Facebook itself, not to this domain, and the name 'venomworksentertainment' is a plausible small-business name with standard IONOS nameservers.
The domain venomworksentertainment.icu redirects to Facebook's login page with a crafted next parameter (https%3A%2F%2Fwww.facebook.com%2FVenomoussmoke444%40gmail.com), a classic phishing technique to capture credentials. The attacker registered an unrelated brand-name domain (.icu TLD, generic nameservers) solely to redirect victims to a legitimate-looking login form, exploiting the trust in Facebook's domain while controlling the attack vector.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Thursday, September 10, 2026
Same data as JSON: /api/zone/domain/venomworksentertainment.icu. This page is not indexed by search engines and does not link to the site it describes.