21chhck0rd3r45532357895.cfd
Appeared in the .cfd zone on Saturday, September 5, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain serves no content of its own: it 302s to www.google.com, so all Google branding/forms in the evidence belong to the destination, not this host. The name itself is a leetspeak-obfuscated, digit-padded string ('chhck0rd3r' ~ 'check order') on a cheap .cfd TLD behind Cloudflare NS — the classic shape of a smishing/spam order-confirmation lure that cloaks to Google for scanners and reachable-page checks, but there is no live malicious content yet to confirm.
The domain name 21chhck0rd3r45532357895.cfd exhibits DGA characteristics (algorithmically-generated random string) and redirects to www.google.com without serving its own content. This is a redirect squat: the domain itself does not impersonate Google, but the obfuscated name combined with Cloudflare nameservers and a .cfd TLD (a spam-prone extension) is consistent with a redirect campaign intended to manipulate traffic or SEO. The redirect to Google's legitimate site does not legitimize the dom
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Saturday, September 5, 2026
Same data as JSON: /api/zone/domain/21chhck0rd3r45532357895.cfd. This page is not indexed by search engines and does not link to the site it describes.