brand in the name “adobe”lure words (login, verify, secure…) “portal”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Model opinion: looks like abuse (target: Adobe), confidence 55%. An opinion, not a finding.
brand in the name “alipay”TLD with a high abuse rate “makeup”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more
Model opinion: looks like abuse (target: Alipay), confidence 76%. An opinion, not a finding.
brand in the name “amazon”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Model opinion: looks like phishing (target: Amazon), confidence 93%. An opinion, not a finding.
brand in the name “amazon”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
Model opinion: looks like phishing (target: Amazon), confidence 92%. An opinion, not a finding.
brand in the name “scotiabank”lure words (login, verify, secure…) “secure”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 45%. An opinion, not a finding.
brand in the name “bestbuy”lure words (login, verify, secure…) “account”very long name “32”brand name at a retail registrar “Tucows Domains Inc.”
brand in the name “booking”lure words (login, verify, secure…) “confirm,confirmation”very long name “30”brand plus digits “booking-confirmation2990826app”+2 more
brand in the name “booking”lure words (login, verify, secure…) “confirm,confirmation”very long name “29”brand plus digits “booking-confirmation300826app”+2 more
brand in the name “booking”lure words (login, verify, secure…) “confirm,confirmation”brand plus digits “booking-confirmation3826app”brand name behind Cloudflare “cloudflare.com”+1 more
one-letter brand typo “booming≈booking”brand plus digits “booming-meme4d”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “chatgpt”lure words (login, verify, secure…) “access”TLD with a high abuse rate “top”brand name at a retail registrar “成都西维数码科技有限公司”
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “recover,recovery”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “myhostdns-ia.pro”+2 more
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
brand in the name “wellsfargo”lure words (login, verify, secure…) “secure”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “DomainRegistry.com LLC”
brand spelled with digits “corpus44→usaa”brand plus digits “corpus44”brand name on a rarely-seen nameserver “assetict.net”brand name at a retail registrar “Tucows Domains Inc.”
brand in the name “icloud”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+1 more
Model opinion: looks like abuse (target: APKMirror), confidence 60%. An opinion, not a finding.
brand in the name “desjardins”lure words (login, verify, secure…) “validation”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
one-letter brand typo “bonking≈booking”many hyphens “3”TLD with a high abuse rate “xyz”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “ebay”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+2 more
Model opinion: looks like a scam (target: eBay), confidence 85%. An opinion, not a finding.
brand in the name “openai”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
brand in the name “facebook”lure words (login, verify, secure…) “login”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “fedex”TLD with a high abuse rate “sbs”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Model opinion: looks like abuse (target: FedEx), confidence 78%. An opinion, not a finding.
brand in the name “fedex”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+1 more
Model opinion: looks like abuse (target: FedEx), confidence 78%. An opinion, not a finding.
brand in the name “fedex”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”brand name and brand-styled page “fedex”
Model opinion: looks like phishing (target: FedEx), confidence 93%. An opinion, not a finding.
brand in the name “icloud”very long name “36”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”+1 more
Model opinion: looks benign, confidence 58%. An opinion, not a finding.
brand in the name “google”lure words (login, verify, secure…) “verification”very long name “58”brand plus digits “google-site-verificationbraesvyebikyznrd”+1 more
brand in the name “google”lure words (login, verify, secure…) “verification”very long name “58”brand plus digits “google-site-verificationbraesvyebikyznrd”+1 more
brand in the name “google”lure words (login, verify, secure…) “verification”very long name “58”brand plus digits “google-site-verificationbraesvyebikyznrd”+1 more
brand in the name “google”lure words (login, verify, secure…) “verification”very long name “58”brand plus digits “google-site-verificationbraesvyebikyznrd”+1 more
brand in the name “google”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+2 more
Model opinion: looks like abuse (target: Google), confidence 65%. An opinion, not a finding.
brand spelled with digits “hi888v4→bbva”brand plus digits “hi888v4”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
Highhi888v4.winscore 55echoes bbva· registrar placeholder brand spelled with digits “hi888v4→bbva”brand plus digits “hi888v4”TLD with a high abuse rate “win”brand name at a retail registrar “NameCheap, Inc.”+2 more
Model opinion: suspicious, confidence 52%. An opinion, not a finding.
brand in the name “icloud”brand plus digits “icloudweb-ext1476”TLD with a high abuse rate “click”brand name on a rarely-seen nameserver “textxinfo.pro”+2 more
brand in the name “icloud”brand plus digits “icloudweb-ext1476”brand name on a rarely-seen nameserver “textxinfo.pro”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “icloud”brand plus digits “icloudweb-ext1476”brand name on a rarely-seen nameserver “textxinfo.pro”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “apple”brand plus digits “idc1-apple”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more
brand in the name “apple”brand plus digits “idc2-apple”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more
brand in the name “apple”brand plus digits “idc3-apple”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more
brand in the name “apple”brand plus digits “idc4-apple”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more
brand in the name “apple”brand plus digits “idc5-apple”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more
brand in the name “apple”brand plus digits “idc6-apple”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc.”brand name at a watch-list registrar “Dynadot Inc.”+2 more
Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.
brand in the name “icloud”brand plus digits “katherineorozco526icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”+1 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
one-letter brand typo “ladger≈ledger”lure words (login, verify, secure…) “recover,recovery”brand name on a rarely-seen nameserver “lurstanhost.net”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.S.”
brand in the name “tmobile”TLD with a high abuse rate “cam”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse, confidence 68%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1073 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “access”brand name at a retail registrar “Global Domain Group LLC”
Model opinion: unreachable when judged, confidence 70%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “pay”many hyphens “3”brand plus digits “mobile-pay-casino-pro365”+5 more
Model opinion: looks like abuse, confidence 57%. An opinion, not a finding.
brand in the name “outlook”lure words (login, verify, secure…) “id”brand name at a retail registrar “DNSPod, Inc.”
brand in the name “paypal”lure words (login, verify, secure…) “login,support”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”