cvcarvx.xyz
Appeared in the .xyz zone on Sunday, September 6, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
cvcarvx.xyz serves no content of its own and 302s to www.google.com; all Google branding and the search form belong to the destination, so there is no impersonation by this domain. A random-string .xyz on Cloudflare NS parked behind a Google redirect is a common holding/cloaking pattern for a campaign not yet live, but on current evidence there is nothing deceptive to judge.
The domain cvcarvx.xyz is a brand-squat redirect: it has no legitimate purpose of its own, uses a typosquat-pattern name (CVC + random letters + .xyz), and exists only to redirect visitors to Google's real site. The redirect itself is the abuse—the domain is parked for deception, not phishing (which would require credential capture on a fake page controlled by the attacker).
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Sunday, September 6, 2026
Same data as JSON: /api/zone/domain/cvcarvx.xyz. This page is not indexed by search engines and does not link to the site it describes.