Highscore 46 · flagged Thursday, November 5, 2026

jiutianhudanbaoyanzheng.xyz

Appeared in the .xyz zone on Thursday, November 5, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: xyz
+8
brand in page title, not in the name
matched: telegram
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Dynadot Inc
Nameserver provider
Nameservers
ns1.dyna-ns.net, ns2.dyna-ns.net
First-day state
active website
HTTP status
200
Page title
九天狐担保验证 · 管理后台
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 60%· claude-opus-5-5

The page is the self-branded admin login for a Telegram bot called 九天狐担保验证 (Nine-Tailed Fox guarantee verification), used for guarantor rosters and group bookkeeping. It mentions Telegram only as the platform it integrates with and says its admin accounts are separate from Telegram accounts, so it is not impersonating Telegram. Telegram 担保 (escrow-guarantee) groups often serve grey-market trading, which lowers confidence, but nothing here deceives visitors or harvests third-party credentials.

First passlooks like phishingtarget: Telegramconfidence 92%· claude-haiku-4-5

The page impersonates a Telegram bot admin backend, displaying a login form (後台賬號/登录密码) that posts credentials to itself with no offsite links. The page title and content repeatedly reference 'Telegram 管理後台' (Telegram admin backend), and the text explicitly states credentials are managed separately from Telegram accounts, creating a false admin portal designed to capture login credentials for a Telegram-based service.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, November 5, 2026

Screenshot of jiutianhudanbaoyanzheng.xyz taken by the zone census on 2026-11-05

Same data as JSON: /api/zone/domain/jiutianhudanbaoyanzheng.xyz. This page is not indexed by search engines and does not link to the site it describes.