maha168-zoom.site
Appeared in the .site zone on Thursday, September 10, 2026; by the end of that day the census found placeholder page. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Site serves only an empty LiteSpeed directory listing (Index of / with cgi-bin), so there is no content to judge; the name pattern 'maha168' matches the numeric-suffix naming used by Asian online-gambling mirror domains, and 'zoom' here reads as a suffix rather than an impersonation of Zoom (no Zoom branding, no login form). Real but not yet decisive signals.
Domain name combines 'zoom' with numeric prefix 'maha168' in a typosquat pattern, registered via retail registrar NameSilo. However, the live page shows only a bare directory listing with a cgi-bin folder and no login form, credential capture attempt, or Zoom branding/impersonation on the page itself. The infrastructure (Cloudflare NS, LiteSpeed server) and placeholder content suggest setup in progress rather than active phishing, but the intentional brand-in-name choice indicates malicious inte
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Thursday, September 10, 2026
Same data as JSON: /api/zone/domain/maha168-zoom.site. This page is not indexed by search engines and does not link to the site it describes.