ebay-kleinanzeigen-id1029.help
Appeared in the .help zone on Tuesday, September 15, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The name 'ebay-kleinanzeigen-id1029.help' is a numbered brand-impersonating hostname (the id#### suffix implies a mass-generated series) on Cloudflare NS with a .help TLD, and it currently 302s to the genuine www.kleinanzeigen.de — the classic cloak/warm-up posture of the German Kleinanzeigen 'secure payment/shipping' phishing kits that later serve credential or card capture pages; no content of its own gives it any legitimate purpose.
The domain ebay-kleinanzeigen-id1029.help uses eBay's brand name and Kleinanzeigen's product name with an arbitrary ID suffix, then redirects to the legitimate Kleinanzeigen site. This is a classic phishing setup: the attacker registers a deceptive domain to appear legitimate, captures the redirect in their infrastructure (Cloudflare nameservers under their control), and can inject a login form or intercept credentials before forwarding to the real site. The domain name is impersonation by desig
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Tuesday, September 15, 2026
Same data as JSON: /api/zone/domain/ebay-kleinanzeigen-id1029.help. This page is not indexed by search engines and does not link to the site it describes.