Highscore 42 · flagged Wednesday, November 4, 2026

d91fa.com

Appeared in the .com zone on Wednesday, November 4, 2026; by the end of that day the census found active website about news media. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Binance
+22
brand in page title, not in the name
matched: binance
+20
Registrar
NameSilo, LLC
Nameserver provider
Nameservers
eloise.ns.cloudflare.com, leland.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
Crypto.Zone | Cutting-Edge Security News & Insights Space
Has a form
no
Brand echoed
—

Model opinions

First passsuspicioustarget: Binanceconfidence 72%· claude-haiku-4-5

The page presents itself as 'Crypto.Zone', a security news platform, but heavily features Binance brand language and a breaking-news narrative about a Binance breach. The scorer correctly flagged brand impersonation (Binance in title, not domain name). However, this is ambiguous: it could be legitimate crypto-incident reporting that happens to cover Binance, or it could be a lure designed to drive Binance users to the site under false pretenses. No login form or credential-capture attempt is vis

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Wednesday, November 4, 2026

Screenshot of d91fa.com taken by the zone census on 2026-11-04

Same data as JSON: /api/zone/domain/d91fa.com. This page is not indexed by search engines and does not link to the site it describes.