Highscore 55 · flagged Monday, August 31, 2026

americaexpress.xyz

Appeared in the .xyz zone on Monday, August 31, 2026; by the end of that day the census found placeholder page. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

one-letter brand typo
matched: americaexpress≈americanexpress
+28
TLD with a high abuse rate
matched: xyz
+8
brand name at a retail registrar
matched: İsimtescil Bilişim A.Ş.
+8
form on a brand-styled page
matched: has_form
+18
Registrar
İsimtescil Bilişim A.Ş.
Nameserver provider
Nameservers
eu.dnsenable.com, tr.dnsenable.com, us.dnsenable.com
First-day state
placeholder page
HTTP status
200
Page title
isimtescil.net | Türkiye'nin Domain ve Hosting Lideri | Hoş geldiniz
Has a form
yes
Brand echoed
americanexpress

Model opinions

Second opinionlooks like abusetarget: American Expressconfidence 60%· claude-opus-5

Domain is a one-letter typosquat of americanexpress.com registered at a Turkish retail registrar, and currently serves only the İsimtescil 'coming soon' placeholder (the only form is the ASP.NET __VIEWSTATE of that template, not a credential form) — no content, so the sole plausible purpose is brand-squatting on American Express pending future use.

First passlooks benignconfidence 95%· claude-haiku-4-5

This is a legitimate domain parking page by İsimtescil, a Turkish hosting registrar. The page title, content, and branding all belong to isimtescil.net, not American Express. The domain name americaexpress.xyz is simply a parked domain registered through their service, with a standard free parking template explaining the domain is 'coming soon' — a normal registrar placeholder, not a phishing attempt to impersonate American Express.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, August 31, 2026

Screenshot of americaexpress.xyz taken by the zone census on 2026-08-31

Same data as JSON: /api/zone/domain/americaexpress.xyz. This page is not indexed by search engines and does not link to the site it describes.