Flagged newborn domains, Tuesday, September 1, 2026

7 names at tier high or above in .app, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highfind-i-cloud.appscore 55echoes icloud· redirects elsewhere
brand in the nameicloudbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSav.com, LLCbrand name at a watch-list registrarSav.com, LLC+3 more

Model opinion: looks like abuse (target: Apple), confidence 68%. An opinion, not a finding.

Highgooglereviewcalculator.appscore 55echoes google· redirects elsewhere
brand in the namegooglebrand name at a retail registrarDynadot LLC.brand name at a watch-list registrarDynadot LLC.brand name and brand-styled pagegoogle+1 more

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Highrecoverpayments.appscore 48· active website
lure words (login, verify, secure…)payment,payments,recoverpage asks for credentialsSign in to your account

Model opinion: looks benign, confidence 55%. An opinion, not a finding.

Highinstagramvideoindir.appscore 44echoes instagram· not probed yet
brand in the nameinstagrambrand name at a retail registrarDynadot LLC.brand name at a watch-list registrarDynadot LLC.
Highpetwitter.appscore 44echoes twitter· robots.txt denied
brand in the nametwitterbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB
Highhechat.appscore 42echoes wechat· robots.txt denied
one-letter brand typohechat≈wechatbrand name at a retail registrarPorkbun LLCbrand name at a watch-list registrarPorkbun LLC
Highmanyhats.appscore 42· active website
page impersonates a brandIRSbrand in page title, not in the nameledger

Same data as JSON: /api/zone/risk?day=2026-09-01&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.