Flagged newborn domains, Monday, August 31, 2026
6,851 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “secure”TLD with a high abuse rate “click”free DNS provider “dnsowl.com”
page impersonates a brand “DHL”
TLD with a high abuse rate “top”login form “has_form+login words”
TLD with a high abuse rate “xyz”login form “has_form+login words”
TLD with a high abuse rate “sbs”login form “has_form+login words”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “binance”
TLD with a high abuse rate “monster”login form “has_form+login words”
page impersonates a brand “IRS”
brand in the name “usaa”TLD with a high abuse rate “click”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
page impersonates a brand “Microsoft 365”
TLD with a high abuse rate “bid”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “MetaMask”
page impersonates a brand “IRS”
page impersonates a brand “IRS”
page impersonates a brand “MetaMask”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “MetaMask”
page impersonates a brand “Binance”
lure words (login, verify, secure…) “verify”TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”
page impersonates a brand “PayPal”
brand in the name “icloud”brand plus digits “volticloud3”
page impersonates a brand “Netflix”
TLD with a high abuse rate “xyz”login form “has_form+login words”
TLD with a high abuse rate “click”login form “has_form+login words”
punycode name “로동자혁명축구단 scripts=HANGUL”very long name “30”
punycode name “ทองดีแฟคทอรี่คาเฟ่ scripts=THAI”very long name “32”
punycode name “한강푸르지오리버프론트 scripts=HANGUL”very long name “37”
punycode name “actividades-cristianas-paraniñosyjovenes”very long name “40”
punycode name “中国紫外光敏管网 scripts=CJK”very long name “29”
punycode name “frserviçoscobrancaecomercioltda scripts=”very long name “31”
punycode name “得到很多很多人的野人 scripts=CJK”very long name “31”
punycode name “卡在洗衣机的姐姐 scripts=CJK”very long name “28”
punycode name “야동티비바로가기 scripts=HANGUL”very long name “30”
punycode name “가락동노래방알바 scripts=HANGUL”very long name “29”
punycode name “牡丹江市西安区臻域驼宝驼奶商店 scripts=CJK”very long name “50”
punycode name “マンション売却のコツ scripts=CJK/HIRAGANA/KATAKANA”very long name “28”
page impersonates a brand “Apple ID”
TLD with a high abuse rate “top”login form “has_form+login words”
random-looking name “H=3.92”TLD with a high abuse rate “cfd”free DNS provider “dnsowl.com”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
Same data as JSON: /api/zone/risk?day=2026-08-31&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.