Highscore 42 · flagged Friday, September 18, 2026

hedger.vip

Appeared in the .vip zone on Friday, September 18, 2026; by the end of that day the census found empty page. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

one-letter brand typo
matched: hedger≈ledger
+28
brand name behind Cloudflare
matched: cloudflare.com
+6
brand name at a retail registrar
matched: GoDaddy.com, LLC
+8
Registrar
GoDaddy.com, LLC
Nameserver provider
Nameservers
doug.ns.cloudflare.com, susan.ns.cloudflare.com
First-day state
empty page
HTTP status
200
Page title
Hedger 对冲者
Has a form
no
Brand echoed
ledger

Model opinions

Second opinionsuspiciousconfidence 58%· claude-opus-5

Page is a self-branded Chinese-language operator console ("HEDGER 对冲者 · 对打中控·公用控制台") with an account/password gate and a note that credentials stay in localStorage — no Ledger logo, wallet-seed prompt or crypto-brand language, so the hedger≈ledger typo flag is a false positive on a real English word. The "对打中控" (matched-betting/arbitrage central control) framing points to tooling for gambling arbitrage account farms, which is plausibly abuse-adjacent, but the gated console gives no visitor-facin

First passlooks like phishingtarget: Ledgerconfidence 95%· claude-haiku-4-5

The domain hedger.vip is a typosquat of Ledger (a cryptocurrency hardware wallet brand). The page displays a login form with 'HEDGER' branding and Chinese text (对冲者 = hedger), claiming to be a 'public trading platform' (公用控制台), but the form posts credentials to itself with no legitimate offsite links—the classic sealed-room phishing pattern designed to capture user credentials.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, September 18, 2026

Screenshot of hedger.vip taken by the zone census on 2026-09-18

Same data as JSON: /api/zone/domain/hedger.vip. This page is not indexed by search engines and does not link to the site it describes.