Flagged newborn domains, Thursday, August 27, 2026
17,538 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
brand in the name “lineme”identical page on many newborns “638 identical pages”
lure words (login, verify, secure…) “security”many hyphens “3”very long name “31”TLD with a high abuse rate “top”
brand in the name “itau”identical page on many newborns “4900 identical pages”
brand in the name “itau”identical page on many newborns “638 identical pages”
lure words (login, verify, secure…) “login,service,services”many hyphens “3”
lure words (login, verify, secure…) “login,portal,service”many hyphens “3”
lure words (login, verify, secure…) “service,services”very long name “30”free DNS provider “dnsowl.com”
lure words (login, verify, secure…) “service,services”very long name “33”free DNS provider “dnsowl.com”
lure words (login, verify, secure…) “service,services,tax”many hyphens “3”
brand in the name “revolut”identical page on many newborns “688 identical pages”
brand in the name “google”very long name “29”brand name on a rarely-seen nameserver “cyberapuestas.com”
brand in the name “adobe”identical page on many newborns “126 identical pages”
lure words (login, verify, secure…) “secure”many hyphens “5”very long name “43”TLD with a high abuse rate “sbs”
lure words (login, verify, secure…) “auth,portal,service”many hyphens “3”
lure words (login, verify, secure…) “security”many hyphens “4”very long name “42”TLD with a high abuse rate “top”
lure words (login, verify, secure…) “invoice”many hyphens “3”very long name “34”TLD with a high abuse rate “lol”
lure words (login, verify, secure…) “account,support”very long name “34”TLD with a high abuse rate “click”
lure words (login, verify, secure…) “security,support”very long name “33”TLD with a high abuse rate “click”
lure words (login, verify, secure…) “support,verification”very long name “38”TLD with a high abuse rate “click”
very long name “29”brand in page title, not in the name “telegram”
lure words (login, verify, secure…) “secure”many hyphens “4”very long name “40”TLD with a high abuse rate “cfd”
lure words (login, verify, secure…) “official”many hyphens “3”very long name “30”TLD with a high abuse rate “top”
lure words (login, verify, secure…) “service,services”very long name “28”TLD with a high abuse rate “xyz”
punycode name “부산-해운대-고구려-룸사롱 scripts=HANGUL”many hyphens “3”
punycode name “수에스테틱 scripts=HANGUL”form submits over plain HTTP “http://xn--9p4b2j94fb6qf4b.shop/”
punycode name “포스영어 scripts=HANGUL”form submits over plain HTTP “http://xn--9t4b29cug022c.shop/”
punycode name “cavèlie-beauty-by-eliza scripts=LATIN”many hyphens “3”
punycode name “iagestoría scripts=LATIN”form submits over plain HTTP “http://xn--iagestora-n5a.com/”
punycode name “køkkenhøjmultiservice scripts=LATIN”lure words (login, verify, secure…) “service”
punycode name “operaçãoresgatofficial scripts=LATIN”lure words (login, verify, secure…) “official”
punycode name “ténéréofficial scripts=LATIN”lure words (login, verify, secure…) “official”
punycode name “vitóriadelivery scripts=LATIN”lure words (login, verify, secure…) “delivery”
brand in the name “zelle”identical page on many newborns “688 identical pages”
brand in the name “amazon”brand name at a retail registrar “Amazon Registrar, Inc.”brand's own DNS (reduces score) “ns-1484.awsdns-57.org”
lure words (login, verify, secure…) “access,portal”many hyphens “3”random-looking name “H=3.89”
punycode name “大连共享网 scripts=CJK”random-looking name “H=4.06”
punycode name “成都边境贸易网 scripts=CJK”random-looking name “H=3.80”
punycode name “山西环境治理网 scripts=CJK”random-looking name “H=3.80”
punycode name “杭州环境治理网 scripts=CJK”random-looking name “H=4.05”
punycode name “青莲逸境 scripts=CJK”random-looking name “H=3.64”
punycode name “반듯디자인 scripts=HANGUL”random-looking name “H=3.88”
punycode name “반듯한마케팅 scripts=HANGUL”random-looking name “H=4.10”
punycode name “เรือนพยากรณ์ scripts=THAI”random-looking name “H=4.06”
punycode name “เสื้อกีฬา scripts=THAI”random-looking name “H=3.85”
punycode name “เสื้อกีฬา scripts=THAI”random-looking name “H=3.85”
punycode name “南充电商网 scripts=CJK”random-looking name “H=3.68”
punycode name “揭阳全屋定制网 scripts=CJK”random-looking name “H=3.94”
punycode name “全屋定制家居网 scripts=CJK”random-looking name “H=4.10”
punycode name “广州安全科技网 scripts=CJK”random-looking name “H=3.64”
punycode name “成都红心柚网 scripts=CJK”random-looking name “H=3.94”
Same data as JSON: /api/zone/risk?day=2026-08-27&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.