xn--7brq64a.xyz
Appeared in the .xyz zone on Friday, September 18, 2026; by the end of that day the census found active website about crypto web3. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Chinese-language 'NG集团官方导航站' gateway page aggregating quick-entry links to unlicensed offshore gambling brands (NG娱乐, C7娱乐, 汇赢国际, PC28/捕鱼/真人), plus 深夜福利 adult and 在线电影 piracy sections and a 客服 live-chat widget; the MetaMask/Trust Wallet/Binance items are a wallet-download link list on a gambling portal, not brand impersonation, and the punycode 初心 .xyz name behind Cloudflare fits the disposable mirror-domain shape of these navigation-site campaigns.
The page is a gambling/casino aggregator portal (NG Casino, C7, various sports betting platforms) that lists MetaMask, Binance, OKX and other cryptocurrency wallet tools as 'common tools' to funnel traffic to unlicensed gambling sites. The punycode domain and links to suspicious hosts (pgpg520.sbs, jnd28.sbs) suggest this is an unlicensed gambling front, not a MetaMask phish—MetaMask is mentioned as a tool, not impersonated as the page operator.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, September 18, 2026
Same data as JSON: /api/zone/domain/xn--7brq64a.xyz. This page is not indexed by search engines and does not link to the site it describes.