Highscore 55 · flagged Sunday, August 30, 2026

hi888v4.win

Appeared in the .win zone on Sunday, August 30, 2026; by the end of that day the census found registrar placeholder. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand spelled with digits
matched: hi888v4→bbva
+35
brand plus digits
matched: hi888v4
+8
TLD with a high abuse rate
matched: win
+8
brand name at a retail registrar
matched: NameCheap, Inc.
+8
brand name at a watch-list registrar
matched: NameCheap, Inc.
+6
identical page on many newborns
matched: 3394 identical pages
+10
Registrar
NameCheap, Inc.
Nameserver provider
Nameservers
dns1.registrar-servers.com, dns2.registrar-servers.com
First-day state
registrar placeholder
HTTP status
200
Page title
Has a form
no
Brand echoed
bbva

Model opinions

Second opinionsuspiciousconfidence 52%· claude-opus-5

Page is only the standard Namecheap 'recently registered' parking placeholder (one of 3394 identical pages), so there is no deceptive content yet; however the name pattern hi888v4.win (brand+digits plus a 'v4' version suffix on a .win TLD) matches the mirror-domain naming used by Asian unlicensed betting brands like hi88, warranting a re-check once content appears. The scorer's 'bbva' leet match is a false positive.

First passlooks benignconfidence 92%· claude-haiku-4-5

This is a Namecheap parking/auction page displaying the default template for recently registered domains. The page is branded with Namecheap's own logo and messaging, contains no login form or attempt to capture credentials, and simply advertises domain auctions. While the domain name hi888v4.win contains leet-speak (888→8, likely referencing BBVA numerically), the page itself makes no impersonation attempt—it is transparently a Namecheap registrar placeholder showing the domain is for sale.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Sunday, August 30, 2026

Screenshot of hi888v4.win taken by the zone census on 2026-08-30

Same data as JSON: /api/zone/domain/hi888v4.win. This page is not indexed by search engines and does not link to the site it describes.