TLD Threat Intelligence

Flagged .xyz Domains

320 domains using the .xyz extension have been flagged by threat-intelligence feeds. The .xyz extension is among the most-abused top-level domains in published phishing-landscape data, which is why it appears frequently in scam infrastructure.

320
Flagged Domains
28
Avg Risk Score
Jul 5
Last Flagged

Flagged .xyz Domains

60 shown
DomainLast Seen
72597.xyz Jul 5 vhnp4ovl.1xcart.xyz Jul 5 88472.xyz Jul 4 88471.xyz Jul 4 16574.xyz Jul 4 16685.xyz Jul 4 16564.xyz Jul 4 16560.xyz Jul 4 71978.xyz Jul 4 16563.xyz Jul 4 17880.xyz Jul 4 88443.xyz Jul 4 88446.xyz Jul 4 88764.xyz Jul 4 88680.xyz Jul 4 88465.xyz Jul 4 parkom.xyz Jul 4 jwyclcz.shartbandi.xyz Jul 4 18098.xyz Jul 3 ahkam.xyz Jul 3 7lm2xwqz.1x1bet.xyz Jul 3 18046.xyz Jul 2 18097.xyz Jul 2 18123.xyz Jul 2 18134.xyz Jul 2 p5tnetyi.footb.xyz Jul 2 gxlrw.ia2nz.xyz Jul 1 18381.xyz Jul 1 jnioz.ia2nz.xyz Jul 1 ieqkd.ia2nz.xyz Jul 1 jsdep.ia2nz.xyz Jul 1 kqxkd.ia2nz.xyz Jul 1 18341.xyz Jul 1 p87d.xyz Jul 1 jbwzs.ia2nz.xyz Jul 1 rdqai.ia2nz.xyz Jul 1 18071.xyz Jul 1 brrpz.ia2nz.xyz Jul 1 ntnjq.ia2nz.xyz Jul 1 llhmj.ia2nz.xyz Jul 1 89403.xyz Jul 1 18334.xyz Jul 1 18060.xyz Jul 1 kwlke.ia2nz.xyz Jul 1 dvhuu.ia2nz.xyz Jul 1 18075.xyz Jul 1 lancer.shartboro.xyz Jul 1 ygl9tk3l.ekhtelalattabrizi.xyz Jun 24 haqoakt0.elmolnafs.xyz Jun 24 engelabeslami.xyz Jun 24 latinaria.xyz Jun 23 nqw33qaj.engelabiran.xyz Jun 23 d52cv625.ahkam.xyz Jun 23 xgj65td7.engelabshafifar.xyz Jun 23 yw1tz6yc.englishekhtesasi.xyz Jun 23 jb9ff818.azmoondadrasi.xyz Jun 22 nwkvg7b4.qurankarim.xyz Jun 22 l3q1ng7a.azmoondadrasi.xyz Jun 21 bbzvqin8.zamineravan.xyz Jun 21 ceitnaao.zamineravanshenasi.xyz Jun 21

Frequently Asked Questions

Are all .xyz websites scams?

No. The .xyz extension is among the most-abused top-level domains in published phishing-landscape data, which is why it appears frequently in scam infrastructure. Many legitimate sites use .xyz. This page lists only the specific .xyz domains flagged by threat-intelligence feeds — not the extension as a whole.

Why do scammers use .xyz domains?

Scammers favour cheap, fast-to-register extensions with slower abuse enforcement, because they expect the domain to be taken down within days. Registration cost and enforcement speed — not the extension's purpose — drive the choice.

How do I check if a specific .xyz site is safe?

Look it up here or on Google Safe Browsing and VirusTotal, and check its registration date with a WHOIS lookup. Very new domains imitating an established brand are a strong warning sign.

🔐Security Partner

Stop the next phishing attack before you click.

NordPass autofill only triggers on real domains. Fake login pages cannot trick it into entering your credentials.

Try NordPass →
← All flagged TLDs