web-mobile.icu
Appeared in the .icu zone on Monday, August 31, 2026; by the end of that day the census found placeholder page. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The apex serves only an open LiteSpeed directory index (php.ini plus a 'pusula.web-mobile.icu' subdomain), with no brand imagery, no form and no impersonation content; the 'mobile≈tmobile' match is a weak generic-word coincidence, but a freshly-registered .icu with an exposed staging directory and a Turkish-gambling-flavoured subdomain ('pusula') warrants monitoring rather than a clean verdict.
The domain web-mobile.icu contains a brand-typo similarity to T-Mobile and uses the .icu TLD (common in abuse campaigns), but the current page is an empty server directory listing with no phishing content, login forms, or deceptive branding. This is a typosquat domain parked or in early staging; the abuse is in the registration itself rather than active impersonation on the visible page.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Monday, August 31, 2026
Same data as JSON: /api/zone/domain/web-mobile.icu. This page is not indexed by search engines and does not link to the site it describes.