Flagged newborn domains, Wednesday, September 2, 2026

24 names at tier low or above on nameservers run by systemdns.com, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highar-invoice-linkedln.comscore 55echoes linkedin
one-letter brand typolinkedln≈linkedinlure words (login, verify, secure…)invoicebrand name at a retail registrarTucows Domains Inc.
Highinstragram.onlinescore 55echoes instagram· boilerplate page
one-letter brand typoinstragram≈instagrambrand name at a retail registrarTucows Domains Inc.form on a brand-styled pagehas_formidentical page on many newborns41 identical pages

Model opinion: looks like abuse (target: Instagram), confidence 72%. An opinion, not a finding.

Highmlcrosoft-onlline365.comscore 44echoes microsoft
one-letter brand typomlcrosoft≈microsoftbrand plus digitsmlcrosoft-onlline365brand name at a retail registrarTucows Domains Inc.
Mediumgoogleworkpace.comscore 38echoes google
brand in the namegooglebrand name at a retail registrarTucows Domains Inc.
Mediumpecaz.orgscore 38· redirects elsewhere
brand in page title, not in the namenetflixform on a brand-styled pagehas_form
Mediumvzwireless-mobile.comscore 36echoes tmobile· empty page
one-letter brand typomobile≈tmobilebrand name at a retail registrarTucows Domains Inc.
Lowbramis.photoscore 20· empty page
brand in page title, not in the namesquarespace
Lowebooktransforman.comscore 20· other
brand in page title, not in the namecloudflare
Lowbahulubilal.comscore 14echoes hulu· empty page
brand in the namehulu
Lowhazell-eg.comscore 14echoes zelle· blocked the probe
brand in the namezelle
Low1stchairservices.comscore 12· boilerplate page
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)recover,recovery
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
lure words (login, verify, secure…)service,services
many hyphens3very long name28
many hyphens4very long name33
many hyphens4very long name30

Same data as JSON: /api/zone/risk?day=2026-09-02&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.