ff18oui.xyz
Appeared in the .xyz zone on Saturday, August 29, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain serves no content of its own and simply 302s to the genuine www.facebook.com, so no credentials are captured by it; however a freshly registered random-string .xyz on Namecheap behind Cloudflare NS whose only behaviour is bouncing visitors to a major social login is the classic cloaked/parked stage of a redirect campaign, warranting monitoring rather than a phishing call.
The domain ff18oui.xyz is a nonsensical typosquat name that redirects to Facebook's legitimate site. The domain itself does not impersonate Facebook (it has no branding or deceptive content), but its sole apparent purpose is to capture traffic through redirect manipulation and likely to generate referral value or track users. This is a clear squat with no legitimate use case.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Saturday, August 29, 2026
Same data as JSON: /api/zone/domain/ff18oui.xyz. This page is not indexed by search engines and does not link to the site it describes.