kleinanzeigen-bezahling-de-bwnmxenjmwka473829.shop
Appeared in the .shop zone on Friday, October 2, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The name joins 'kleinanzeigen' with 'bezahling-de' (misspelled 'Bezahlung', payment) and a random per-victim token on a throwaway .shop TLD behind Cloudflare, which is the known pattern of Kleinanzeigen 'secure payment' phishing kits. The redirect to google.com is a typical cloak to hide the payload from scanners, and the Google content is not the domain's own.
The domain name 'kleinanzeigen-bezahling-de-bwnmxenjmwka473829.shop' is a typosquat impersonating eBay Kleinanzeigen (a German classifieds platform) combined with a payment-themed word ('bezahling'), designed to deceive users into believing they are on a legitimate payment or account page. The redirect to Google's homepage via a deceptive domain name—rather than direct navigation—is a classic phishing redirect technique used to harvest credentials or distribute malware after credential capture o
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, October 2, 2026
Same data as JSON: /api/zone/domain/kleinanzeigen-bezahling-de-bwnmxenjmwka473829.shop. This page is not indexed by search engines and does not link to the site it describes.