Highscore 55 · flagged Friday, September 4, 2026

bro138ay.site

Appeared in the .site zone on Friday, September 4, 2026; by the end of that day the census found placeholder page. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand spelled with digits
matched: bro138ay→ebay
+35
brand plus digits
matched: bro138ay
+8
brand name at a retail registrar
matched: NameCheap, Inc.
+8
brand name at a watch-list registrar
matched: NameCheap, Inc.
+6
Registrar
NameCheap, Inc.
Nameserver provider
Nameservers
dns1.registrar-servers.com, dns2.registrar-servers.com
First-day state
placeholder page
HTTP status
200
Page title
Index of /
Has a form
no
Brand echoed
ebay

Model opinions

Second opinionsuspiciousconfidence 60%· claude-opus-5

Empty Apache directory index containing only a dmca-validation.html stub — no content to judge, but the name follows the well-known Indonesian slot-gambling naming pattern (brand + '138', cf. the BRO138 gambling brand) and the DMCA-badge file is typical of gambling/piracy affiliate sites being staged behind Cloudflare; the scorer's 'ebay' leet match is spurious and there is no eBay imitation on the page.

First passsuspiciousconfidence 65%· claude-haiku-4-5

Domain name bro138ay.site contains leet-speak encoding of 'ebay' (138→ebay), which is a classic typosquat pattern. However, the current page is only a bare directory listing with no login form, no eBay branding, and no content attempting to impersonate eBay or capture credentials. The DMCA validation file suggests the domain may have been flagged for abuse. The evidence indicates this is a squat domain in waiting, but without active phishing content currently deployed, it registers as suspicious

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, September 4, 2026

Screenshot of bro138ay.site taken by the zone census on 2026-09-04

Same data as JSON: /api/zone/domain/bro138ay.site. This page is not indexed by search engines and does not link to the site it describes.