Flagged newborn domains, Tuesday, September 1, 2026

29 names at tier low or above in .help, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalwebchat.helpscore 60echoes wechat· active website
one-letter brand typowebchat≈wechatbrand name at a retail registrarPorkbun LLCbrand name at a watch-list registrarPorkbun LLCform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Hightrezorupdate.helpscore 55echoes trezor· no DNS
brand in the nametrezorlure words (login, verify, secure…)updatebrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLC+1 more
Highicloudfinder.helpscore 52echoes icloud· empty page
brand in the nameicloudfree DNS providerdnsowl.combrand name at a retail registrarNameSilo, LLCbrand name at a watch-list registrarNameSilo, LLC

Model opinion: suspicious (target: Apple), confidence 72%. An opinion, not a finding.

Highmicrosoft365-oauth.helpscore 52echoes microsoft· active website
brand in the namemicrosoftbrand plus digitsmicrosoft365-oauthbrand name at a retail registrarNameSilo, LLCbrand name at a watch-list registrarNameSilo, LLC

Model opinion: suspicious (target: Microsoft), confidence 65%. An opinion, not a finding.

Hightrezorupgrade.helpscore 50echoes trezor· no DNS
brand in the nametrezorbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLCbrand name at a watch-list registrarNameSilo, LLC
Mediumform-id29942913.helpscore 38· redirects elsewhere
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumid53926.helpscore 38· redirects elsewhere
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumhukun.helpscore 28· empty page
free DNS providerdnsowl.combrand in page title, not in the nametelegram
Lowaba-network.helpscore 20· blocked the probe
brand in page title, not in the namecloudflare
Lowarchitecturalnetwork.helpscore 20· blocked the probe
brand in page title, not in the namecloudflare
Lowglobalsttorr.helpscore 20· blocked the probe
brand in page title, not in the namecloudflare
Lowheimsheetmetal.helpscore 20· blocked the probe
brand in page title, not in the namecloudflare
Lowpremierrealtynetwork.helpscore 20· blocked the probe
brand in page title, not in the namecloudflare
Lowpurify.helpscore 20· active website
brand in page title, not in the nametelegram
Lowsaicnorancreoinesreoonline.helpscore 20· blocked the probe
brand in page title, not in the namecloudflare
Lowwin55.helpscore 20· server error
brand in page title, not in the namecloudflare
Lowbank-of-america.helpscore 16echoes bankofamerica· no DNS
brand in the namebankofamericabrand name behind Cloudflarecloudflare.com
Lowcontact-supporst-unlock-notification.helpscore 16· not probed yet
lure words (login, verify, secure…)unlockmany hyphens3very long name36
Lowrbcaccess-cancellationportal-request.helpscore 16· robots.txt denied
lure words (login, verify, secure…)access,portalvery long name36
Lowwells-fargo.helpscore 16echoes wellsfargo· no DNS
brand in the namewellsfargobrand name behind Cloudflarecloudflare.com
Lowidjremember-eki-net.helpscore 14· no web server
lure words (login, verify, secure…)memberfree DNS providerdnsowl.com
Lowidjreseting-eki-net.helpscore 14· no web server
lure words (login, verify, secure…)resetfree DNS providerdnsowl.com
Lowregain-access.helpscore 14· no web server
lure words (login, verify, secure…)accessfree DNS providerdnsowl.com
Lowcontestationsecure-support.helpscore 12· robots.txt denied
lure words (login, verify, secure…)secure,support
Lowcustomerspace.helpscore 12· registrar placeholder
lure words (login, verify, secure…)customer,customers
Lowlawnservices.helpscore 12· suspended
lure words (login, verify, secure…)service,services
Lowsmallclaimscourt.helpscore 12· no web server
lure words (login, verify, secure…)claim,claims
Lowsmallclaimslegal.helpscore 12· no web server
lure words (login, verify, secure…)claim,claims
Lowtax-portal.helpscore 12· no DNS
lure words (login, verify, secure…)portal,tax

Same data as JSON: /api/zone/risk?day=2026-09-01&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.