Highscore 46 · flagged Monday, November 2, 2026

ainhalam.xyz

Appeared in the .xyz zone on Monday, November 2, 2026; by the end of that day the census found redirects elsewhere. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: xyz
+8
brand in page title, not in the name
matched: chatgpt
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
ns1.matbao.com, ns2.matbao.com
First-day state
redirects elsewhere
HTTP status
200
Page title
AI Nhà Làm - Tài khoản AI, phần mềm và công cụ học tập bản quyền
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 72%· claude-opus-5-5

ainhalam.xyz is a same-name sister domain that redirects to ainhalam.net, a Vietnamese storefront under its own brand 'AI Nhà Làm'. That storefront openly resells ChatGPT, Claude, Canva and Office accounts via VietQR, with a search form and Telegram/Messenger support. It is a grey-market reseller using its own branding, not a page posing as OpenAI or any other brand to harvest credentials.

First passlooks like a scamconfidence 92%· claude-haiku-4-5

ainhalam.xyz redirects to ainhalam.net, a Vietnamese account-reselling shop claiming to sell ChatGPT, Claude, Gemini, Office, and YouTube Premium subscriptions. This is a credential-harvesting and payment-fraud scam: it collects payment via VietQR (Vietnamese bank transfer), promises instant account delivery, but sells stolen or fraudulently obtained credentials. The form, Telegram operator contact, and the classic resale-shop pattern (no impersonation of the brands themselves, but fraudulent sa

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, November 2, 2026

Screenshot of ainhalam.xyz taken by the zone census on 2026-11-02

Same data as JSON: /api/zone/domain/ainhalam.xyz. This page is not indexed by search engines and does not link to the site it describes.