brand in the name “gmail”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “etsy”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “DNSPod, Inc.”
brand in the name “gmail”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “amazon”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
brand in the name “google”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “hulu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CV. Jogjacamp”
brand in the name “gmail”many hyphens “3”brand name at a retail registrar “Name.com, Inc.”
brand in the name “whatsapp”brand name on a rarely-seen nameserver “srv53.com”brand name at a retail registrar “Internet Invest, Ltd. dba Imena.ua”
brand in the name “lineme”brand plus digits “lineme5876”brand name behind Cloudflare “cloudflare.com”
brand in the name “lineme”brand plus digits “lineme5896”brand name behind Cloudflare “cloudflare.com”
brand in the name “lineme”brand plus digits “lineme5996”brand name behind Cloudflare “cloudflare.com”
brand in the name “lineme”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “linkedin”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
brand in the name “linkedin”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CNOBIN INFORMATION TECHNOLOGY LIMITED”
brand in the name “tiktok”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
brand in the name “lloyds”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “shopify”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
lure words (login, verify, secure…) “support”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “amazon”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
page asks for credentials “Login to your account”login form “has_form+login words”
Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “onedrive”brand name on a rarely-seen nameserver “awsdns-05.net”brand name at a retail registrar “Amazon Registrar, Inc.”
brand in the name “microsoft”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NETIM SAS”
brand in the name “microsoft”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “mizuho”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “mizuho”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
one-letter brand typo “mlcrosoft≈microsoft”brand plus digits “mlcrosoft-online1”brand name at a retail registrar “Tucows Domains Inc.”
one-letter brand typo “mlcrosoft≈microsoft”brand plus digits “mlcrosoft-onlline365”brand name at a retail registrar “Tucows Domains Inc.”
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-wanbo888”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
lure words (login, verify, secure…) “track”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
page asks for credentials “Sign in to your account”login form “has_form+login words”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “netflix”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “netflix”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “outlook”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “TuringSign Inc. d/b/a Cosmotown”
brand in the name “gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “whatsapp”brand name on a rarely-seen nameserver “srv53.com”brand name at a retail registrar “Internet Invest, Ltd. dba Imena.ua”
brand in the name “openai”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “C-Soft Oy dba NordName”
brand in the name “openai”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “opensea”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “disney”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “outlook”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “outlook”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Network Solutions, LLC”
brand in the name “robinhood”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “chatgpt”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “linkedin”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in page title, not in the name “google”form on a brand-styled page “has_form”form submits over plain HTTP “http://postmark-appsender.org/”
Model opinion: looks like phishing (target: Google), confidence 82%. An opinion, not a finding.
brand in the name “shopify”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.