Flagged newborn domains, Wednesday, September 2, 2026
2,506 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
page impersonates a brand “Netflix”brand in page title, not in the name “facebook”
Model opinion: looks like abuse, confidence 89%. An opinion, not a finding.
one-letter brand typo “ledgerv≈ledger”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “xbox”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
one-letter brand typo “linkme≈lineme”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Global Domain Group LLC”
Model opinion: unreachable when judged, confidence 82%. An opinion, not a finding.
brand in the name “telegram”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”
Model opinion: looks benign, confidence 92%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand name on a rarely-seen nameserver “octenium.net”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
one-letter brand typo “mobile≈tmobile”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “cloud≈icloud”brand name on a rarely-seen nameserver “aeza-dns.ru”brand name at a retail registrar “OnlineNIC, Inc.”
page impersonates a brand “MetaMask”brand in page title, not in the name “metamask”
Model opinion: suspicious (target: MetaMask), confidence 72%. An opinion, not a finding.
brand in the name “kakao”brand plus digits “opkakao01”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “finance≈binance”brand name on a rarely-seen nameserver “co.il”brand name at a retail registrar “eNom, LLC”
one-letter brand typo “finance≈binance”brand name on a rarely-seen nameserver “systalink.com”brand name at a retail registrar “NETIM SAS”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “amazon”TLD with a high abuse rate “yachts”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
one-letter brand typo “finance≈binance”brand name on a rarely-seen nameserver “v-sys.org”brand name at a retail registrar “Host Africa (Pty.) Ltd.”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
one-letter brand typo “playpal≈paypal”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
one-letter brand typo “posttl≈postnl”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
brand in the name “usaa”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”
Model opinion: looks benign, confidence 92%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CNOBIN INFORMATION TECHNOLOGY LIMITED”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “robinhood”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”form on a brand-styled page “has_form”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
page impersonates a brand “Binance”brand in page title, not in the name “binance”
one-letter brand typo “craken≈kraken”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
one-letter brand typo “finance≈binance”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “tiktok”very long name “28”brand name at a retail registrar “Wix.com Ltd.”
one-letter brand typo “stirling≈starling”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
one-letter brand typo “strpe≈stripe”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
page impersonates a brand “Netflix”brand in page title, not in the name “robinhood”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
page impersonates a brand “Binance”brand in page title, not in the name “binance”
one-letter brand typo “mobile≈tmobile”brand name on a rarely-seen nameserver “stratoserver.net”brand name at a retail registrar “InterNetX GmbH”
one-letter brand typo “xfifnity≈xfinity”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “xfinite≈xfinity”brand name on a rarely-seen nameserver “sureserver.com”brand name at a retail registrar “eNom, LLC”
one-letter brand typo “xfiniuty≈xfinity”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “itau”brand name at a retail registrar “CV. Rumahweb Indonesia”form on a brand-styled page “has_form”
many hyphens “3”very long name “29”brand in page title, not in the name “hostinger”identical page on many newborns “86 identical pages”
lure words (login, verify, secure…) “member,members”TLD with a high abuse rate “rest”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “payment,payments”TLD with a high abuse rate “buzz”brand in page title, not in the name “cloudflare”
ambiguous brand word “monzo”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more
brand in the name “ebay”brand plus digits “1230ebayshoredrive”brand name at a retail registrar “GoDaddy.com, LLC”brand name redirects elsewhere “visionaryperspectives.com”
brand in page title, not in the name “google”form on a brand-styled page “has_form”
brand in the name “binance”brand plus digits “394604-binance”
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Same data as JSON: /api/zone/risk?day=2026-09-02&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.