m0ntramarket.xyz
Appeared in the .xyz zone on Thursday, November 12, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The name 'm0ntramarket' uses a digit-for-letter swap on a 'market' name, a pattern common in darknet-market and crypto mirror-phish lookalikes. It sits on a cheap .xyz via NiceNIC behind Cloudflare and currently bounces visitors to google.com, a typical cloaking placeholder. Since no content of its own is served, the target and intent remain unconfirmed.
The domain m0ntramarket.xyz is a typosquat/redirect squat with no legitimate purpose: it redirects to Google's homepage rather than serving its own content. The typosquat name ('m0ntra' mimicking 'montra' or similar) combined with Cloudflare nameservers and a redirect to an unrelated major brand indicates infrastructure set up for deception, likely to harvest clicks, perform SEO manipulation, or serve as a redirect vector. The domain itself does not impersonate Google (it serves Google's real pa
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Thursday, November 12, 2026
Same data as JSON: /api/zone/domain/m0ntramarket.xyz. This page is not indexed by search engines and does not link to the site it describes.