Highscore 55 · flagged Thursday, October 29, 2026

aqa-lloyd-montes-gw4-1793192304542817159.store

Appeared in the .store zone on Thursday, October 29, 2026; by the end of that day the census found other. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

one-letter brand typo
matched: lloyd≈lloyds
+28
many hyphens
matched: 4
+6
very long name
matched: 40
+4
brand plus digits
matched: aqa-lloyd-montes-gw4-1793192304542817159
+8
brand in page title, not in the name
matched: cloudflare
+20
Registrar
—
Nameserver provider
Nameservers
autodsdomains.mercury.orderbox-dns.com, autodsdomains.venus.orderbox-dns.com
First-day state
other
HTTP status
409
Page title
DNS resolution error | aqa-lloyd-montes-gw4-1793192304542817159.store | Cloudflare
Has a form
no
Brand echoed
lloyds

Model opinions

Second opinionlooks benignconfidence 72%· claude-opus-5-5

The nameservers (autodsdomains.*.orderbox-dns.com) and the name pattern (person's name 'lloyd-montes' plus a random ID) match an auto-provisioned AutoDS dropshipping store domain, not a Lloyds Bank typosquat. The only content is a genuine Cloudflare Error 1001 DNS page with no form or brand impersonation.

First passlooks benignconfidence 92%· claude-haiku-4-5

The page is a genuine Cloudflare Error 1001 (DNS resolution error) placeholder, not phishing. Despite the domain name containing a brand-typo ('lloyd' ≈ 'lloyds'), suspicious structure (many hyphens, long random strings), and scorer signals, the page itself displays Cloudflare's legitimate error message explaining DNS misconfiguration, with links to Cloudflare's official documentation. There is no attempt to capture credentials, no login form, and no impersonation—Cloudflare is genuinely serving

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, October 29, 2026

Screenshot of aqa-lloyd-montes-gw4-1793192304542817159.store taken by the zone census on 2026-10-29

Same data as JSON: /api/zone/domain/aqa-lloyd-montes-gw4-1793192304542817159.store. This page is not indexed by search engines and does not link to the site it describes.