brand in the name “tiktok”lure words (login, verify, secure…) “verification”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “netflix”lure words (login, verify, secure…) “verify”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Model opinion: looks like abuse (target: Netflix), confidence 82%. An opinion, not a finding.
brand in the name “fidelity”lure words (login, verify, secure…) “wallet”brand name on a rarely-seen nameserver “glowhost.net”brand name at a retail registrar “OnlineNIC, Inc.”
brand in the name “westpac”lure words (login, verify, secure…) “security”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “OwnRegistrar, Inc.”
brand in the name “whatsapp”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GKG.Net, Inc.”
one-letter brand typo “whtsapp≈whatsapp”lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”brand name at a retail registrar “OVH sas”
brand in the name “wordpress”lure words (login, verify, secure…) “service”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “google”lure words (login, verify, secure…) “secure”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
punycode name “自耵godaddy网站生成器 scripts=CJK/LATIN”brand in the name “godaddy”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”+1 more
brand spelled with digits “yglrbbv4→bbva”brand plus digits “yglrbbv4”TLD with a high abuse rate “top”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
one-letter brand typo “cooking≈booking”brand name at a retail registrar “Name.com, Inc.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “DropCatch.com 442 LLC”identical page on many newborns “168 identical pages”brand name redirects elsewhere “dropcatch.com”
Model opinion: looks benign, confidence 78%. An opinion, not a finding.
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “santander”very long name “56”brand plus digits “consumocreditosantanderclplusf3400badc5f”TLD with a high abuse rate “sbs”+3 more
brand in the name “santander”very long name “49”brand plus digits “consumosantanderplusf340021badc5f856e608”TLD with a high abuse rate “sbs”+3 more
brand in the name “shopify”very long name “34”brand plus digits “httpsadminshopifycomstorefpy5ff-r2”brand name at a retail registrar “Namify Domains Inc”+1 more
Model opinion: looks like abuse (target: Shopify), confidence 82%. An opinion, not a finding.
brand in the name “shopify”very long name “34”brand plus digits “httpsadminshopifycomstorehih1zt-15”brand name at a retail registrar “Namify Domains Inc”+1 more
Model opinion: looks like abuse (target: Shopify), confidence 72%. An opinion, not a finding.
brand in the name “shopify”very long name “36”brand plus digits “httpsadminshopifycomstorehih1zt15app”brand name at a retail registrar “Namify Domains Inc”+1 more
Model opinion: looks like abuse (target: Shopify), confidence 82%. An opinion, not a finding.
brand in the name “itau”brand plus digits “itau777”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”
Model opinion: looks like abuse (target: Itaú Unibanco), confidence 80%. An opinion, not a finding.
one-letter brand typo “mizuvo≈mizuho”brand name at a retail registrar “Tucows Domains Inc.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 82%. An opinion, not a finding.
brand in the name “shopify”very long name “37”brand plus digits “mktohttpsadminshopifycomstorefpy5ffr2”brand name at a retail registrar “Namify Domains Inc”+1 more
Model opinion: looks like abuse (target: Shopify), confidence 82%. An opinion, not a finding.
brand in the name “playstation”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “2798 identical pages”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “revolut”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “2798 identical pages”
Model opinion: looks benign, confidence 92%. An opinion, not a finding.
brand in the name “amazon”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+2 more
Model opinion: looks like abuse (target: Amazon), confidence 72%. An opinion, not a finding.
brand in the name “whatsapp”lure words (login, verify, secure…) “official”brand name on a rarely-seen nameserver “gkg.net”brand name at a retail registrar “GKG.Net, Inc.”
Model opinion: looks like abuse (target: WhatsApp), confidence 78%. An opinion, not a finding.
brand in the name “hostinger”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “hostinger”
Model opinion: looks benign, confidence 82%. An opinion, not a finding.
brand in the name “tiktok”brand name at a retail registrar “Squarespace Domains LLC”brand name and brand-styled page “tiktok”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “137gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Amazon Registrar, Inc.”
brand in the name “tmobile”brand plus digits “777slotmobile”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “kraken”brand plus digits “95921-kraken”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “coinbase”brand plus digits “978489-coinbase”brand name on a rarely-seen nameserver “parktons.com”brand name at a retail registrar “Ultahost, Inc.”
brand in the name “openai”TLD with a high abuse rate “lol”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “adobe”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “gmail”brand plus digits “amolpanchal38gmail”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
one-letter brand typo “mobile≈tmobile”many hyphens “3”very long name “29”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “slack”TLD with a high abuse rate “cyou”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
brand in the name “bybit”brand plus digits “bybitai77”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
lure words (login, verify, secure…) “access”TLD with a high abuse rate “cfd”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “robinhood”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Model opinion: looks like abuse (target: Robinhood), confidence 62%. An opinion, not a finding.
brand in the name “google”TLD with a high abuse rate “click”brand name at a retail registrar “Dynadot, LLC”brand name at a watch-list registrar “Dynadot, LLC”
brand in the name “google”TLD with a high abuse rate “cfd”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “hulu”brand plus digits “hulu365”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
page asks for credentials “Sign in to your account”page impersonates a brand “Netflix”
Model opinion: looks benign, confidence 87%. An opinion, not a finding.
brand in the name “icloud”brand plus digits “katherineorozco526icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
one-letter brand typo “mobile≈tmobile”many hyphens “3”very long name “28”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “tmobile”TLD with a high abuse rate “click”brand name at a retail registrar “Dynadot, LLC”brand name at a watch-list registrar “Dynadot, LLC”
brand in the name “robinhood”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
lure words (login, verify, secure…) “airdrop”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”