Flagged newborn domains, Monday, August 31, 2026

25 names at tier low or above in .cyou, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalshopee1.cyouscore 99echoes shopee· active website
brand in the nameshopeebrand plus digitsshopee1TLD with a high abuse ratecyoubrand name behind Cloudflarecloudflare.com+4 more

Model opinion: looks like phishing (target: Shopee), confidence 97%. An opinion, not a finding.

Higharamesx.cyouscore 55echoes aramex· blocked the probe
one-letter brand typoaramesx≈aramexTLD with a high abuse ratecyoubrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Inc+2 more
Highfinance-uulv.cyouscore 55echoes binance· blocked the probe
one-letter brand typofinance≈binanceTLD with a high abuse ratecyoubrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.+1 more
Highbreeslack.cyouscore 52echoes slack· not probed yet
brand in the nameslackTLD with a high abuse ratecyoubrand name at a retail registrarPorkbun LLCbrand name at a watch-list registrarPorkbun LLC
High123movies-com.cyouscore 46· redirects elsewhere
TLD with a high abuse ratecyoubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.

Highpowergirl.cyouscore 46· redirects elsewhere
TLD with a high abuse ratecyoubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Mediummorvada.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumteleformul.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumtelegroxxs.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumteleguidep.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumuber77way.cyouscore 28· blocked the probe
TLD with a high abuse ratecyoubrand in page title, not in the namecloudflare
Mediumvanbina.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Lowbos138bgwn.cyouscore 22· active website
TLD with a high abuse ratecyoulogin formhas_form+login words
Lowbonuswincok22.cyouscore 14· parked, for sale
lure words (login, verify, secure…)bonusTLD with a high abuse ratecyou
Lowdbt-gov-live.cyouscore 14· active website
lure words (login, verify, secure…)govTLD with a high abuse ratecyou
Lowji-li-asia88-max.cyouscore 14· boilerplate page
many hyphens3TLD with a high abuse ratecyou
Lowji-liasia8-win.cyouscore 14· boilerplate page
lure words (login, verify, secure…)winTLD with a high abuse ratecyou
Lowjili-asia888-win.cyouscore 14· boilerplate page
lure words (login, verify, secure…)winTLD with a high abuse ratecyou
Lowphskyapplogin.cyouscore 14· no DNS
lure words (login, verify, secure…)loginTLD with a high abuse ratecyou
Lowpolice-gov.cyouscore 14· boilerplate page
lure words (login, verify, secure…)govTLD with a high abuse ratecyou
Lowrakishinvoice.cyouscore 14· no DNS
lure words (login, verify, secure…)invoiceTLD with a high abuse ratecyou
Lowsignal-win.cyouscore 14· empty page
lure words (login, verify, secure…)winTLD with a high abuse ratecyou
Lowslot90officialresmi.cyouscore 14· active website
lure words (login, verify, secure…)officialTLD with a high abuse ratecyou
Lowbx3v2molbwm6u79cyepctw.cyouscore 13· no DNS
random-looking nameH=4.10TLD with a high abuse ratecyou
Lowg2nlwyhkxz4ujckr1ciuuh.cyouscore 13· no DNS
random-looking nameH=3.97TLD with a high abuse ratecyou

Same data as JSON: /api/zone/risk?day=2026-08-31&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.