Highscore 55 · flagged Tuesday, September 1, 2026

fsjalonrobinhood.xyz

Appeared in the .xyz zone on Tuesday, September 1, 2026; by the end of that day the census found placeholder page. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: robinhood
+30
TLD with a high abuse rate
matched: xyz
+8
brand name at a retail registrar
matched: NameCheap, Inc.
+8
brand name at a watch-list registrar
matched: NameCheap, Inc.
+6
brand name and brand-styled page
matched: robinhood
+15
Registrar
NameCheap, Inc.
Nameserver provider
Nameservers
dns1.p05.nsone.net, dns2.p05.nsone.net, dns3.p05.nsone.net, dns4.p05.nsone.net
First-day state
placeholder page
HTTP status
200
Page title
FSJAL on Robinhood
Has a form
no
Brand echoed
robinhood

Model opinions

Second opinionsuspiciousconfidence 60%· claude-opus-5

Windows-XP-themed meme-coin promo page ("FSJAL on Robinhood", "CA: Coming soon...", Twitter/token links) that borrows the Robinhood name in the domain without authorisation; no login form or credential capture, but the pre-launch "contract address coming soon" memecoin shape is a common pump/rug lure, so the evidence is real but not yet decisive.

First passsuspicioustarget: Robinhoodconfidence 65%· claude-haiku-4-5

Domain name contains 'robinhood' and page title claims 'FSJAL on Robinhood', suggesting impersonation of the Robinhood trading platform. However, the page content appears to be a fan/community site about 'FSJAL' (a meme character), with no login form, credential capture, or financial transaction mechanism, which weakens the phishing classification. The 'Coming soon' state and cartoon aesthetic suggest this may be a fan project rather than active credential theft, but the domain name+title combin

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, September 1, 2026

Screenshot of fsjalonrobinhood.xyz taken by the zone census on 2026-09-01

Same data as JSON: /api/zone/domain/fsjalonrobinhood.xyz. This page is not indexed by search engines and does not link to the site it describes.