20150526.xyz
Appeared in the .xyz zone on Tuesday, November 3, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain redirects to a genuine Cloudflare Access gate on Cloudflare's own cloudflareaccess.com. The form posts there and asks only for an email to receive a login code. This is a private site behind Zero Trust, not impersonation. The numeric .xyz name and the shared Access team (the login targets 170247.xyz) suggest a series of numbered .xyz domains run by one operator, but nothing on the page or in the name deceives a visitor.
Domain 20150526.xyz redirects to a Cloudflare Access login page impersonating Cloudflare's authentication system. The page displays Cloudflare branding and logo, requests email credentials via a form posting to svt17.cloudflareaccess.com, and uses a numeric hostname (170247) disguised as a legitimate service. The combination of a generic numeric domain name redirecting to a fake Cloudflare Access login page with credential-capture forms is a classic phishing setup designed to deceive users into
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Tuesday, November 3, 2026
Same data as JSON: /api/zone/domain/20150526.xyz. This page is not indexed by search engines and does not link to the site it describes.