voicemailsaccounts-x7k2m9p4q1google-redi-projecj-mail.icu
Appeared in the .icu zone on Tuesday, September 15, 2026; by the end of that day the census found boilerplate page. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Name is a Google voicemail/account lure ('voicemailsaccounts...google...mail') padded with a random token and hyphens on a cheap .icu TLD, and it serves no content of its own but bounces through href.li, a referrer-stripping cloaker typical of credential-phishing kits whose final destination is swapped in per-victim (currently a placeholder example.com).
The domain name is a classic phishing-infrastructure squat combining Google branding, lure words (voicemailsaccounts), and obfuscation (random digits, typos like 'projecj') with the .icu TLD, hosted on Cloudflare nameservers and configured to redirect offsite via href.li. The name itself—not the destination page—is constructed for credential harvesting via deception; this is a typosquat/brand-squat infrastructure domain rather than a content-based phishing page.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Tuesday, September 15, 2026
Same data as JSON: /api/zone/domain/voicemailsaccounts-x7k2m9p4q1google-redi-projecj-mail.icu. This page is not indexed by search engines and does not link to the site it describes.