Flagged newborn domains, Sunday, August 30, 2026
6,707 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “yhq9h请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yhr6m请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “驢總 scripts=CJK”TLD with a high abuse rate “top”
punycode name “穩詞 scripts=CJK”TLD with a high abuse rate “top”
punycode name “yyq375请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqnny请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqpz7请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqsrx请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqx16请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqzdh请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “傷疤 scripts=CJK”TLD with a high abuse rate “top”
punycode name “怪痞 scripts=CJK”TLD with a high abuse rate “top”
punycode name “挽回 scripts=CJK”TLD with a high abuse rate “top”
punycode name “暗號 scripts=CJK”TLD with a high abuse rate “top”
punycode name “声哑 scripts=CJK”TLD with a high abuse rate “top”
lure words (login, verify, secure…) “verify”brand in page title, not in the name “whatsapp”
nameserver domain born the same day “parisky.net”
nameserver domain born the same day “jimbahost.com”
nameserver domain born the same day “jimbahost.com”
nameserver domain born the same day “jimbahost.com”
nameserver domain born the same day “backnorosi-gygy.com”
nameserver domain born the same day “backnorosi-gygy.com”
nameserver domain born the same day “parisky.net”
nameserver domain born the same day “parisky.net”
nameserver domain born the same day “parisky.net”
nameserver domain born the same day “parisky.net”
nameserver domain born the same day “jimbahost.com”
brand in the name “intuit”identical page on many newborns “68 identical pages”
very long name “43”brand in page title, not in the name “cloudflare”
brand in the name “intuit”identical page on many newborns “174 identical pages”
lure words (login, verify, secure…) “security”many hyphens “3”very long name “31”TLD with a high abuse rate “top”
very long name “28”brand in page title, not in the name “instagram”
very long name “28”brand in page title, not in the name “wordpress”
lure words (login, verify, secure…) “service,services”very long name “34”TLD with a high abuse rate “xyz”
brand in the name “epicgames”identical page on many newborns “1190 identical pages”
punycode name “bahíademujer scripts=LATIN”form submits over plain HTTP “http://xn--bahademujer-qcb.online/”
punycode name “bahíademujer scripts=LATIN”form submits over plain HTTP “http://xn--bahademujer-qcb.org/”
punycode name “iványsilvi2026 scripts=LATIN”form submits over plain HTTP “http://xn--ivnysilvi2026-4db.com/”
punycode name “onlinebüroservice scripts=LATIN”lure words (login, verify, secure…) “service”
punycode name “เย็ดดีมาก scripts=THAI”random-looking name “H=3.62”
punycode name “ไฮดรอลิกไทย scripts=THAI”random-looking name “H=3.78”
punycode name “นิวเมติกไทย scripts=THAI”random-looking name “H=3.69”
punycode name “สิทธิโชคการโยธา scripts=THAI”random-looking name “H=3.74”
punycode name “名刺海月 scripts=CJK”random-looking name “H=3.64”
punycode name “南京生命能 scripts=CJK”random-looking name “H=3.84”
punycode name “별내자이더스타 scripts=HANGUL”random-looking name “H=4.02”
punycode name “เรียงเลข scripts=THAI”random-looking name “H=3.64”
punycode name “다원통신 scripts=HANGUL”random-looking name “H=3.62”
punycode name “야동포탈 scripts=HANGUL”random-looking name “H=3.88”
punycode name “야동포털 scripts=HANGUL”random-looking name “H=3.88”
Same data as JSON: /api/zone/risk?day=2026-08-30&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.