compass-finance.xyz
Appeared in the .xyz zone on Saturday, September 12, 2026; by the end of that day the census found active website. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Self-branded Korean personal-finance dashboard ('Compass') with its own email/password signup posting to itself; the 'binance≈finance' typo flag is a false positive and the only offsite link is to Toss Securities' real corporate site. Nothing on the page impersonates Toss, but a day-old .xyz inviting users to 'connect 토스증권' to aggregate brokerage assets is a plausible credential/asset-harvesting funnel, so the evidence is real but not decisive.
The page impersonates Toss Securities (토스증권), a legitimate Korean financial service, by presenting itself as 'Compass' — a financial navigator requiring email/password login. The form posts credentials to itself with no legitimate offsite links, the domain compass-finance.xyz contains a financial brand-typo pattern (finance≈binance), and the page explicitly states users should 'connect Toss Securities' (토스증권을 연결하면) to use the service, deceiving visitors into entering credentials on a fake login
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Saturday, September 12, 2026
Same data as JSON: /api/zone/domain/compass-finance.xyz. This page is not indexed by search engines and does not link to the site it describes.