Criticalscore 60 · flagged Monday, August 31, 2026

dzfire.site

Appeared in the .site zone on Monday, August 31, 2026; by the end of that day the census found active website about ai software. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Paypal
+22
brand in page title, not in the name
matched: paypal
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Spaceship, Inc.
Nameserver provider
Nameservers
launch1.spaceship.net, launch2.spaceship.net
First-day state
active website
HTTP status
200
Page title
Home - DZ Fire
Has a form
yes
Brand echoed

Model opinions

Second opinionlooks benignconfidence 60%· claude-opus-5

The page is a self-branded 'DZ Fire' Algerian wildfire map/AI-tools site; the only PayPal signal is a standard donate button posting to the real www.paypal.com, which is not impersonation, and no credential capture exists on the page. It solicits donations on a brand-new domain with no verifiable charity identity, which is worth monitoring, but nothing on the page deceives visitors about being another organisation.

First passlooks like phishingtarget: PayPalconfidence 92%· claude-haiku-4-5

The page impersonates a legitimate wildfire tracking service but embeds a PayPal donation form that posts to www.paypal.com. The scorer correctly identified brand impersonation: the page title is 'Home - DZ Fire' (not PayPal's brand), yet PayPal is mentioned in the donation section with a form, creating the sealed-room phishing shape where a victim enters payment credentials into what appears to be a charitable donation interface but is actually harvesting PayPal login data.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, August 31, 2026

Screenshot of dzfire.site taken by the zone census on 2026-08-31

Same data as JSON: /api/zone/domain/dzfire.site. This page is not indexed by search engines and does not link to the site it describes.