Highscore 52 · flagged Monday, November 2, 2026

11club.xyz

Appeared in the .xyz zone on Monday, November 2, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: xyz
+8
page asks for credentials
matched: Login to your account
+30
login form
matched: has_form+login words
+14
Registrar
—
Nameserver provider
Nameservers
ns1.fleshdns.net, ns2.fleshdns.net
First-day state
active website
HTTP status
200
Page title
Login - 11Club
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks like abuseconfidence 55%· claude-opus-5-5

The page uses its own '11Club' brand with a mobile-number and password login, Register and Reset Password buttons, and 'Lootle Money' wording on a fresh .xyz domain. This matches the pattern of the '91club/55club'-style colour-prediction gambling and earning apps, so it reads as an unlicensed-gambling or money-lure front rather than a phish, since it imitates no other organisation.

First passlooks like abuseconfidence 85%· claude-haiku-4-5

The domain 11club.xyz hosts a login page for what appears to be an unlicensed gambling or betting operation (suggested by 'Lootle Money' and '11 CLUB' branding), not impersonation of an established brand. The sealed-room credential-harvesting form (posts to self, no offsite links) combined with the gambling-adjacent theme and suspicious nameserver infrastructure (fleshdns.net) indicates this is an unlicensed gambling front or credential-theft operation rather than brand impersonation.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, November 2, 2026

Screenshot of 11club.xyz taken by the zone census on 2026-11-02

Same data as JSON: /api/zone/domain/11club.xyz. This page is not indexed by search engines and does not link to the site it describes.