Flagged newborn domains, Monday, August 31, 2026

12 names at tier medium or above in .cyou, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalshopee1.cyouscore 99echoes shopee· active website
brand in the nameshopeebrand plus digitsshopee1TLD with a high abuse ratecyoubrand name behind Cloudflarecloudflare.com+4 more

Model opinion: looks like phishing (target: Shopee), confidence 97%. An opinion, not a finding.

Higharamesx.cyouscore 55echoes aramex· blocked the probe
one-letter brand typoaramesx≈aramexTLD with a high abuse ratecyoubrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Inc+2 more
Highfinance-uulv.cyouscore 55echoes binance· blocked the probe
one-letter brand typofinance≈binanceTLD with a high abuse ratecyoubrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.+1 more
Highbreeslack.cyouscore 52echoes slack· not probed yet
brand in the nameslackTLD with a high abuse ratecyoubrand name at a retail registrarPorkbun LLCbrand name at a watch-list registrarPorkbun LLC
High123movies-com.cyouscore 46· redirects elsewhere
TLD with a high abuse ratecyoubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.

Highpowergirl.cyouscore 46· redirects elsewhere
TLD with a high abuse ratecyoubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Mediummorvada.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumteleformul.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumtelegroxxs.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumteleguidep.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram
Mediumuber77way.cyouscore 28· blocked the probe
TLD with a high abuse ratecyoubrand in page title, not in the namecloudflare
Mediumvanbina.cyouscore 28· empty page
TLD with a high abuse ratecyoubrand in page title, not in the nametelegram

Same data as JSON: /api/zone/risk?day=2026-08-31&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.