Highscore 55 · flagged Monday, September 28, 2026

on-macrosoft-loginauth.xyz

Appeared in the .xyz zone on Monday, September 28, 2026; by the end of that day the census found no web server. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

one-letter brand typo
matched: macrosoft≈microsoft
+28
lure words (login, verify, secure…)
matched: login
+26
TLD with a high abuse rate
matched: xyz
+8
brand name behind Cloudflare
matched: cloudflare.com
+6
Registrar
—
Nameserver provider
Nameservers
melina.ns.cloudflare.com, pablo.ns.cloudflare.com
First-day state
no web server
HTTP status
—
Page title
—
Has a form
no
Brand echoed
microsoft

Model opinions

Second opinionlooks like abusetarget: Microsoftconfidence 80%· claude-opus-5-5

The name 'on-macrosoft-loginauth' pairs a Microsoft typosquat ('macrosoft') with 'loginauth' on a cheap .xyz TLD, so its only plausible purpose is credential-phishing deception. No web content was served, so there is no live phishing page to confirm, which makes this a brand-squat staged for later use.

First passlooks like abusetarget: Microsoftconfidence 85%· claude-haiku-4-5

Domain name is a clear typosquat ('macrosoft' for 'microsoft') combined with 'loginauth' lure words, registered under a high-abuse TLD (.xyz). No web content is currently hosted, but the name itself—structured to impersonate Microsoft's login infrastructure—indicates preparation for phishing or credential harvesting. The absence of content does not change the malicious intent signaled by the domain registration.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

Same data as JSON: /api/zone/domain/on-macrosoft-loginauth.xyz. This page is not indexed by search engines and does not link to the site it describes.