Flagged newborn domains, Friday, August 28, 2026
2,271 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
brand in the name “xbox”TLD with a high abuse rate “xyz”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”+1 more
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “apple”brand plus digits “koi800-apple”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “microsoft”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+3 more
Model opinion: looks like abuse (target: Microsoft), confidence 78%. An opinion, not a finding.
brand in the name “microsoft”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “microsoft”lure words (login, verify, secure…) “service,services,support”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “microsoft”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “pay”many hyphens “3”brand name behind Cloudflare “cloudflare.com”+3 more
Model opinion: looks like abuse (target: MobilePay), confidence 72%. An opinion, not a finding.
brand in the name “wordpress”brand plus digits “momswordpresscamps46”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “netflix”very long name “30”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Model opinion: looks like phishing (target: Netflix), confidence 88%. An opinion, not a finding.
brand in the name “nintendo”brand name on a rarely-seen nameserver “atakdns.com”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.Ş.”brand name and brand-styled page “nintendo”
Model opinion: looks like phishing (target: Nintendo), confidence 82%. An opinion, not a finding.
brand spelled with digits “nooncolorado83→adobe”brand plus digits “nooncolorado83”brand name on a rarely-seen nameserver “dti-serve.com”brand name at a retail registrar “eNom, LLC”
one-letter brand typo “openapi≈openai”lure words (login, verify, secure…) “service”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “whatsapp”lure words (login, verify, secure…) “payment”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”
one-letter brand typo “phantomm≈phantom”brand plus digits “phantomm-569”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “postnl”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameMart Pte. Ltd.”+2 more
brand in the name “icloud”lure words (login, verify, secure…) “recover”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “fedex”lure words (login, verify, secure…) “delivery”brand plus digits “redelivery43fedex3783”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “whatsapp”lure words (login, verify, secure…) “refund”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”
brand in the name “amazon”lure words (login, verify, secure…) “support”very long name “28”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “royalmail”lure words (login, verify, secure…) “delivery”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more
Model opinion: looks like abuse (target: Royal Mail), confidence 78%. An opinion, not a finding.
brand spelled with digits “sc88va→bbva”brand plus digits “sc88va”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand spelled with digits “sc88va→bbva”brand plus digits “sc88va”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand spelled with digits “sc88va→bbva”brand plus digits “sc88va”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand spelled with digits “sc88va→bbva”brand plus digits “sc88va”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand spelled with digits “sc88va→bbva”brand plus digits “sc88va”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”+1 more
brand spelled with digits “sc88va→bbva”brand plus digits “sc88va”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “secure”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “whatsapp”lure words (login, verify, secure…) “security”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”
brand in the name “google”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “monzo”lure words (login, verify, secure…) “signin”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “slack”TLD with a high abuse rate “mom”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
brand in the name “telegram”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “spotify”brand name at a retail registrar “DropCatch.com 1319 LLC”identical page on many newborns “39 identical pages”brand name redirects elsewhere “dropcatch.com”
Model opinion: looks benign, confidence 62%. An opinion, not a finding.
brand spelled with digits “standard5team→steam”brand plus digits “standard5team”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “starlink”brand plus digits “starlink4dcio”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “starlink”brand plus digits “starlink88”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “starlink”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “hostinger”+1 more
Model opinion: suspicious (target: Starlink (SpaceX)), confidence 60%. An opinion, not a finding.
brand in the name “starlink”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “hostinger”+1 more
Model opinion: looks like abuse (target: Starlink (SpaceX)), confidence 62%. An opinion, not a finding.
brand in the name “google”lure words (login, verify, secure…) “support”brand name at a retail registrar “GoDaddy.com, LLC”
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “homes”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”+1 more
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “google”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “telegraam≈telegram”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+2 more
Model opinion: looks like abuse (target: Telegram), confidence 57%. An opinion, not a finding.
brand in the name “tesla”brand plus digits “tesla-invest24”TLD with a high abuse rate “icu”brand name at a retail registrar “Gname.com Pte. Ltd.”+1 more
one-letter brand typo “tiktik≈tiktok”brand name at a retail registrar “GoDaddy.com, LLC”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
brand in the name “tiktok”lure words (login, verify, secure…) “portal”very long name “29”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “tiktok”brand in page title, not in the name “hostinger”identical page on many newborns “96 identical pages”
Model opinion: looks like abuse (target: TikTok), confidence 55%. An opinion, not a finding.
brand in the name “whatsapp”lure words (login, verify, secure…) “track”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”
brand in the name “ebay”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
brand in the name “usps”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameMart Pte. Ltd.”+1 more
Model opinion: looks like abuse (target: USPS), confidence 80%. An opinion, not a finding.
brand in the name “vanguard”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
Same data as JSON: /api/zone/risk?day=2026-08-28&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.