Highscore 46 · flagged Tuesday, September 22, 2026

555314159.xyz

Appeared in the .xyz zone on Tuesday, September 22, 2026; by the end of that day the census found redirects elsewhere. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: xyz
+8
brand in page title, not in the name
matched: cloudflare
+20
form on a brand-styled page
matched: has_form
+18
Registrar
NameCheap, Inc.
Nameserver provider
Nameservers
finley.ns.cloudflare.com, leanna.ns.cloudflare.com
First-day state
redirects elsewhere
HTTP status
200
Page title
Sign in ・ Cloudflare Access
Has a form
yes
Brand echoed

Model opinions

Second opinionlooks benignconfidence 85%· claude-opus-5

The domain is simply gated behind Cloudflare Access (Zero Trust) — the redirect goes to the owner's own *.cloudflareaccess.com login gate that says 'Log in to 555314159.xyz', which is Cloudflare's genuine product, not an impersonation of it; the numeric .xyz name on Cloudflare NS is unremarkable and the real content is hidden behind the gate.

First passlooks like abuseconfidence 92%· claude-haiku-4-5

The domain 555314159.xyz is a numeric typosquat with no legitimate purpose, redirecting to a Cloudflare Access login page. The page itself is a legitimate Cloudflare Access service (not impersonation of Cloudflare—Access login pages are real infrastructure), but the attacker has registered this meaningless numeric domain and configured it to funnel users through a Cloudflare Access gateway, likely to harvest credentials or control access to phishing infrastructure hosted elsewhere. This is a cla

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, September 22, 2026

Screenshot of 555314159.xyz taken by the zone census on 2026-09-22

Same data as JSON: /api/zone/domain/555314159.xyz. This page is not indexed by search engines and does not link to the site it describes.