Flagged newborn domains, Monday, August 31, 2026

16 names at tier medium or above in .vip, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticaltelegram-ka9.vipscore 67echoes telegram· active website
brand in the nametelegrambrand plus digitstelegram-ka9brand name behind Cloudflarecloudflare.combrand name at a retail registrarJuly Name Limited+1 more

Model opinion: looks like phishing (target: Telegram), confidence 60%. An opinion, not a finding.

Hightrustwallets.vipscore 55echoes trustwallet· no DNS
brand in the nametrustwalletlure words (login, verify, secure…)walletbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Inc+1 more
Highitau777.vipscore 46echoes itau· active website
brand in the nameitaubrand plus digitsitau777brand name at a retail registrarGoDaddy.com, LLC

Model opinion: looks like abuse (target: Itaú), confidence 78%. An opinion, not a finding.

Highdizipal-cloud.vipscore 42echoes icloud· active website
one-letter brand typocloud≈icloudbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Mediumavavav5.vipscore 38· active website
brand in page title, not in the namewordpressform on a brand-styled pagehas_form
Mediumb78383.vipscore 38· active website
brand in page title, not in the namewordpressform on a brand-styled pagehas_form
Mediumcostcoep.vipscore 38echoes costco· no web server
brand in the namecostcobrand name at a retail registrarCommuniGal Communication Ltd.
Mediumtopazlounge.vipscore 38· active website
brand in page title, not in the namebookingform on a brand-styled pagehas_form
Mediumapps-buffalo.vipscore 28· active website
free DNS providerdnsowl.combrand in page title, not in the namegoogle
Mediumbuffalo-apps.vipscore 28· active website
free DNS providerdnsowl.combrand in page title, not in the namegoogle
Mediumbuffalo-games.vipscore 28· active website
free DNS providerdnsowl.combrand in page title, not in the namegoogle
Mediumbuffalo-go.vipscore 28· active website
free DNS providerdnsowl.combrand in page title, not in the namegoogle
Mediumbuffalo-play.vipscore 28· active website
free DNS providerdnsowl.combrand in page title, not in the namegoogle
Mediumgames-buffalo.vipscore 28· active website
free DNS providerdnsowl.combrand in page title, not in the namegoogle
Mediumwahtpp.vipscore 28· redirects elsewhere
free DNS providerdnsowl.combrand in page title, not in the namewhatsapp
Mediumwhsatpp.vipscore 28· redirects elsewhere
free DNS providerdnsowl.combrand in page title, not in the namewhatsapp

Same data as JSON: /api/zone/risk?day=2026-08-31&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.