esteghlaaltwitter.site
Appeared in the .site zone on Monday, August 31, 2026; by the end of that day the census found placeholder page. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The site serves only a LiteSpeed open directory index with a staged upload (tedin.zip, tedin/, php.ini) and no deployed content, so there is nothing deceptive yet; the name combines an Iranian football club (Esteghlal) with 'twitter', suggesting a fan/social page rather than a credible X/Twitter credential phish, but the exposed staging archive warrants re-checking once content is published.
Domain name contains 'twitter' and uses suspicious nameservers (viphost-dns.com), but the actual page content is a blank directory listing with no impersonation attempt. This is a classic brand-squat setup: the domain name opportunistically includes a brand word, but there is no phishing page, no login form, and no attempt to deceive visitors into thinking this is Twitter. The exposed directory with PHP files and archives suggests infrastructure staging or malware hosting rather than credential
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Monday, August 31, 2026
Same data as JSON: /api/zone/domain/esteghlaaltwitter.site. This page is not indexed by search engines and does not link to the site it describes.