Flagged newborn domains, Tuesday, September 1, 2026
12,278 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
many hyphens “4”very long name “36”page impersonates a brand “PayPal”
very long name “30”TLD with a high abuse rate “cyou”brand in page title, not in the name “cloudflare”
brand in the name “ebay”form on a brand-styled page “has_form”
very long name “28”TLD with a high abuse rate “cyou”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
very long name “32”TLD with a high abuse rate “cyou”brand in page title, not in the name “cloudflare”
many hyphens “3”very long name “28”page impersonates a brand “PayPal”
very long name “33”TLD with a high abuse rate “xyz”brand in page title, not in the name “starlink”
very long name “33”TLD with a high abuse rate “xyz”brand in page title, not in the name “starlink”
very long name “31”TLD with a high abuse rate “cyou”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “recover,recovery”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “recover,recovery”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “whatsapp”
very long name “30”TLD with a high abuse rate “cyou”brand in page title, not in the name “cloudflare”
punycode name “月拍阁 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--9su07g0x7c.top/”
punycode name “醬料食用總匯 scripts=CJK”random-looking name “H=3.92”TLD with a high abuse rate “top”
punycode name “北京环球度假区 scripts=CJK”random-looking name “H=3.89”TLD with a high abuse rate “xyz”
punycode name “汽车车身件平台 scripts=CJK”random-looking name “H=4.00”TLD with a high abuse rate “top”
punycode name “汽車車身件平台 scripts=CJK”random-looking name “H=4.00”TLD with a high abuse rate “top”
punycode name “高价兼职 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “xyz”
punycode name “灵云渡信 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “icu”
punycode name “農業機械網 scripts=CJK”random-looking name “H=3.62”TLD with a high abuse rate “top”
punycode name “宝马娱乐 scripts=CJK”random-looking name “H=3.75”TLD with a high abuse rate “top”
punycode name “酱料食用总汇 scripts=CJK”random-looking name “H=3.88”TLD with a high abuse rate “top”
punycode name “心理服務 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “千美批發 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “香蕉市場 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “宝马国际 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “农业机械网 scripts=CJK”random-looking name “H=4.06”TLD with a high abuse rate “top”
punycode name “開元棋牌 scripts=CJK”random-looking name “H=3.88”TLD with a high abuse rate “top”
punycode name “开元棋牌 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “心理服务 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
many hyphens “3”very long name “28”brand in page title, not in the name “cloudflare”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
TLD with a high abuse rate “top”page impersonates a brand “Coinbase”
brand in the name “amazon”
page asks for credentials “Login to Account”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
free DNS provider “dnsowl.com”page impersonates a brand “Paypal”
free DNS provider “dnsowl.com”page impersonates a brand “Paypal”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
TLD with a high abuse rate “top”page impersonates a brand “Coinbase”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “104 identical pages”
Same data as JSON: /api/zone/risk?day=2026-09-01&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.