brand in the name “amazon”TLD with a high abuse rate “top”brand name at a retail registrar “Dynadot LLC”brand name at a watch-list registrar “Dynadot LLC”+3 more
Model opinion: looks like phishing (target: Amazon), confidence 95%. An opinion, not a finding.
brand in the name “shopee”brand plus digits “shopee1”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”+4 more
Model opinion: looks like phishing (target: Shopee), confidence 97%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more
Model opinion: looks like abuse, confidence 66%. An opinion, not a finding.
Criticalntflix.shopscore 88echoes netflix· active website one-letter brand typo “ntflix≈netflix”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”
Model opinion: looks like a scam (target: Netflix), confidence 82%. An opinion, not a finding.
Critical1lloyds.comscore 85echoes lloyds· active website brand in the name “lloyds”brand plus digits “1lloyds”brand name on a rarely-seen nameserver “awsdns-24.org”brand name at a retail registrar “Amazon Registrar, Inc.”+2 more
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “4ktiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+2 more
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”+1 more
Model opinion: looks benign, confidence 62%. An opinion, not a finding.
ambiguous brand word “phantom”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
brand in the name “robinhood”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “robinhood”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 65%. An opinion, not a finding.
brand in the name “etsy”TLD with a high abuse rate “monster”brand name on a rarely-seen nameserver “dreamsdns.com”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”+1 more
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
page asks for credentials “Log In to Your Account”brand in page title, not in the name “sharepoint”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Microsoft SharePoint), confidence 96%. An opinion, not a finding.
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
page asks for credentials “log in to your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.
brand in the name “telegram”brand plus digits “telegram-ka9”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “July Name Limited”+1 more
Model opinion: looks like phishing (target: Telegram), confidence 60%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “leonardo11francagmail”brand name at a retail registrar “Name.com, Inc.”brand in page title, not in the name “whatsapp”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more
Model opinion: looks benign, confidence 82%. An opinion, not a finding.
brand in the name “openai”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “instagram”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “tmobile”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand in page title, not in the name “namecheap”
Model opinion: looks like phishing (target: Salam Mobile (Saudi Arabia)), confidence 82%. An opinion, not a finding.
brand spelled with digits “lotus44→usaa”brand plus digits “lotus44”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
Criticalairb2b.sitescore 62echoes airbnb· active website one-letter brand typo “airb2b≈airbnb”brand plus digits “airb2b”brand name at a retail registrar “Name.com, Inc.”form on a brand-styled page “has_form”
Model opinion: suspicious (target: Airbnb), confidence 72%. An opinion, not a finding.
brand in the name “fidelity”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 78%. An opinion, not a finding.
one-letter brand typo “qoogle≈google”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand in page title, not in the name “google”
Model opinion: looks like phishing (target: Google), confidence 95%. An opinion, not a finding.
brand in the name “usaa”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Allbirds), confidence 92%. An opinion, not a finding.
brand in the name “robinhood”TLD with a high abuse rate “fun”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “robinhood”
Model opinion: looks like a scam, confidence 68%. An opinion, not a finding.
page impersonates a brand “Paypal”brand in page title, not in the name “roblox”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
page impersonates a brand “Paypal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name on a rarely-seen nameserver “mitelis.cc”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 68%. An opinion, not a finding.
page impersonates a brand “Microsoft 365”brand in page title, not in the name “sharepoint”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 94%. An opinion, not a finding.
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.
page impersonates a brand “NETFLIX”brand in page title, not in the name “xbox”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 62%. An opinion, not a finding.
page impersonates a brand “HMRC”brand in page title, not in the name “hmrc”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 62%. An opinion, not a finding.
brand spelled with digits “n96ci7au→itau”brand plus digits “n96ci7au”TLD with a high abuse rate “top”brand name at a retail registrar “Dominet (HK) Limited”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “aramex”brand name at a retail registrar “Sav.com, LLC”brand name at a watch-list registrar “Sav.com, LLC”page pushes urgent payment “guaranteed returns”
Model opinion: looks like a scam, confidence 92%. An opinion, not a finding.
brand in the name “revolut”TLD with a high abuse rate “rest”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+1 more
Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.
one-letter brand typo “chatppt≈chatgpt”TLD with a high abuse rate “cam”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
brand in the name “ionos”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
punycode name “нано-банана scripts=CYRILLIC”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
punycode name “нанобанана scripts=CYRILLIC”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 55%. An opinion, not a finding.
brand in the name “coinbase”brand plus digits “301849coinbase”random-looking name “H=3.81”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Model opinion: looks like abuse (target: Coinbase), confidence 78%. An opinion, not a finding.
brand in the name “coinbase”brand plus digits “302841coinbase”random-looking name “H=3.81”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Model opinion: looks like abuse (target: Coinbase), confidence 78%. An opinion, not a finding.
brand spelled with digits “3bayar77→ebay”brand plus digits “3bayar77”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “coinbase”brand plus digits “54893-coinbase”random-looking name “H=3.70”brand name on a rarely-seen nameserver “parktons.com”+1 more
brand in the name “coinbase”brand plus digits “591248coinbase”random-looking name “H=3.81”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “google”lure words (login, verify, secure…) “account,accounts”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “airbnb”TLD with a high abuse rate “homes”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “whatsapp”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “instagram”
Model opinion: suspicious (target: WhatsApp), confidence 60%. An opinion, not a finding.
brand in the name “amazon”brand plus digits “amazonshopping6”brand name at a retail registrar “NameMart Pte. Ltd.”brand name and brand-styled page “amazon”
Model opinion: looks like phishing (target: Amazon), confidence 93%. An opinion, not a finding.
one-letter brand typo “americaexpress≈americanexpress”TLD with a high abuse rate “xyz”brand name at a retail registrar “İsimtescil Bilişim A.Ş.”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: American Express), confidence 60%. An opinion, not a finding.
brand spelled with digits “app1e-icloud→apple”brand plus digits “app1e-icloud”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: looks like abuse (target: Apple), confidence 85%. An opinion, not a finding.