Flagged newborn domains, Friday, August 28, 2026

18 names at tier low or above on nameservers run by webnic.cc, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highverifycard12512-booking.comscore 55echoes booking
brand in the namebookinglure words (login, verify, secure…)verifybrand plus digitsverifycard12512-bookingbrand name at a retail registrarWeb Commerce Communications Limited dba +1 more
Highfinance-p.appscore 42echoes binance· no web server
one-letter brand typofinance≈binancebrand name at a retail registrarWeb Commerce Communications Limited dba brand name at a watch-list registrarWeb Commerce Communications Limited dba
Lowpaymentsltelnk.clickscore 20· no web server
lure words (login, verify, secure…)payment,paymentsTLD with a high abuse rateclick
Lowservicepayment.icuscore 20· no web server
lure words (login, verify, secure…)payment,serviceTLD with a high abuse rateicu
Lowwalletconnect-refund9314.sbsscore 20· no web server
lure words (login, verify, secure…)refund,walletTLD with a high abuse ratesbs
Lowcom-account-v3-api-tax.appscore 18· no web server
lure words (login, verify, secure…)account,taxmany hyphens4
Lowcom-account-options-passport.appscore 16· no web server
lure words (login, verify, secure…)accountmany hyphens3very long name28
Lowfun-wallets-v3-apps-connects-api.appscore 16· no web server
lure words (login, verify, secure…)walletmany hyphens5very long name32
Lowauthtrumpwallet.cfdscore 14· no web server
lure words (login, verify, secure…)walletTLD with a high abuse ratecfd
Lowbiatbonus.cfdscore 14· no web server
lure words (login, verify, secure…)bonusTLD with a high abuse ratecfd
Lowecheckpayment.clickscore 14· no web server
lure words (login, verify, secure…)paymentTLD with a high abuse rateclick
Lowid-582991.sbsscore 14· no web server
lure words (login, verify, secure…)idTLD with a high abuse ratesbs
Lowzitouna-bonuss.sbsscore 14· no web server
lure words (login, verify, secure…)bonusTLD with a high abuse ratesbs
Lowag-v3-wallets-api-connects.appscore 12· no web server
lure words (login, verify, secure…)walletmany hyphens4
Lowag-wallets-v2-api-connect.appscore 12· no web server
lure words (login, verify, secure…)walletmany hyphens4
Lowio-api-connects-wallet-v2.appscore 12· no web server
lure words (login, verify, secure…)walletmany hyphens4
Lowio-api-connects-wallets-v3.appscore 12· no web server
lure words (login, verify, secure…)walletmany hyphens4
Lowcom-banking-personal-api-v2-online.appscore 10· no web server
many hyphens5very long name34

Same data as JSON: /api/zone/risk?day=2026-08-28&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.