brand in the name “whatsapp”lure words (login, verify, secure…) “verify”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”
brand in the name “hsbc”lure words (login, verify, secure…) “verify”brand name on a rarely-seen nameserver “nsnamedns.net”brand name at a retail registrar “OwnRegistrar, Inc.”
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “verifycard12512-booking”brand name at a retail registrar “Web Commerce Communications Limited dba ”+1 more
brand in the name “google”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CloudFlare, Inc.”
Model opinion: looks like abuse (target: Google), confidence 72%. An opinion, not a finding.
brand in the name “ionos”TLD with a high abuse rate “zip”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”+1 more
brand in the name “coinbase”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “OwnRegistrar, Inc.”
brand in the name “wellsfargo”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
brand in the name “westpac”lure words (login, verify, secure…) “secure”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “OwnRegistrar, Inc.”
brand in the name “twitter”brand name at a retail registrar “GoDaddy.com LLC”brand name and brand-styled page “twitter”form on a brand-styled page “has_form”
brand spelled with digits “yesoncolorado83→adobe”brand plus digits “yesoncolorado83”brand name on a rarely-seen nameserver “dti-serve.com”brand name at a retail registrar “eNom, LLC”
one-letter brand typo “mobile≈tmobile”many hyphens “4”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “DEVEXPANSE LTD d/b/a Regery.com”+1 more
TLD with a high abuse rate “click”free DNS provider “dnsowl.com”brand in page title, not in the name “roblox”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.
brand in the name “openai”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3924 identical pages”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “hsbc”lure words (login, verify, secure…) “secure”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “outlook”many hyphens “7”very long name “35”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “shopify”very long name “51”brand plus digits “httpsadminshopifycomstoreni10w2f1setting”brand name at a retail registrar “Namify Domains Inc”+1 more
Model opinion: looks like abuse (target: Shopify), confidence 82%. An opinion, not a finding.
brand in the name “intuit”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”identical page on many newborns “1814 identical pages”
Model opinion: looks benign, confidence 94%. An opinion, not a finding.
one-letter brand typo “paypql≈paypal”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
brand in the name “revolut”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3924 identical pages”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
Highrobloxs.taxscore 54echoes roblox· registrar placeholder brand in the name “roblox”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3924 identical pages”
Model opinion: looks like abuse (target: Roblox), confidence 72%. An opinion, not a finding.
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”identical page on many newborns “196 identical pages”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
brand in the name “fidelity”brand name at a retail registrar “Squarespace Domains II LLC”brand name and brand-styled page “fidelity”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “Squarespace Domains II LLC.”brand name and brand-styled page “amazon”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “twitter”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “twitter”
Model opinion: looks like abuse (target: Twitter/X), confidence 86%. An opinion, not a finding.
brand in the name “telegram”brand plus digits “234bettelegram”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
brand in the name “amazon”brand plus digits “3dshamazonghui”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more
Model opinion: looks like abuse (target: Amazon), confidence 60%. An opinion, not a finding.
brand in the name “robinhood”brand plus digits “408971-robinhood”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “OwnRegistrar, Inc.”
brand in the name “gmail”brand plus digits “4175gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “TuringSign Inc. d/b/a Cosmotown”
brand in the name “coinbase”brand plus digits “483774-coinbase”brand name on a rarely-seen nameserver “parktons.com”brand name at a retail registrar “Ultahost, Inc.”
brand in the name “google”brand plus digits “70190-google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “icloud”brand plus digits “7aicloud”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
lure words (login, verify, secure…) “account”TLD with a high abuse rate “icu”brand in page title, not in the name “quickbooks”form on a brand-styled page “has_form”
one-letter brand typo “amazoon≈amazon”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”identical page on many newborns “97 identical pages”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
lure words (login, verify, secure…) “verify”TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “ledger”brand plus digits “authorization21-ledger”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “ledger”brand plus digits “authorization22-ledger”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “ledger”brand plus digits “authorization23-ledger”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “cashapp”brand plus digits “b9cashapp”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
TLD with a high abuse rate “sbs”page asks for credentials “Sign In to Your Account”login form “has_form+login words”
Model opinion: looks like phishing (target: Bancus), confidence 66%. An opinion, not a finding.
brand in the name “disney”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Model opinion: looks like abuse (target: Disney+), confidence 72%. An opinion, not a finding.
brand in the name “facebook”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Model opinion: suspicious, confidence 58%. An opinion, not a finding.
brand in the name “google”brand plus digits “google93”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
brand in the name “hubspot”brand plus digits “hubspot2”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “tmobile”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GLOBAL ASSET DOMAINS INC.”
brand in the name “hulu”brand plus digits “jiejijinhulu2mianfeiban”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “hulu”brand plus digits “jinhulu2daijiejidanjiban”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
brand in the name “hulu”brand plus digits “jinhulu2danjiban”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “hulu”brand plus digits “jinhulu2danjibanmianfeiban”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
brand in the name “microsoft”brand plus digits “microsoftoffice365live”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “MAT BAO CORPORATION”