one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “portal”brand name on a rarely-seen nameserver “iaasdns.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “docusign”lure words (login, verify, secure…) “portal”TLD with a high abuse rate “work”free DNS provider “dnsowl.com”+3 more
Model opinion: looks like abuse (target: DocuSign), confidence 72%. An opinion, not a finding.
brand in the name “docusign”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Squarespace Domains II LLC”
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1375 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “etsy”lure words (login, verify, secure…) “verification”brand name at a retail registrar “Global Domain Group LLC”
one-letter brand typo “eubank≈nubank”brand plus digits “eubank-30”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “fidelity”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”brand name and brand-styled page “fidelity”+1 more
Model opinion: looks benign, confidence 94%. An opinion, not a finding.
brand in the name “fidelity”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “127 identical pages”
Model opinion: looks like abuse (target: Fidelity Investments), confidence 66%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”brand name and brand-styled page “amazon”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
brand spelled with digits “fit-4-u→itau”brand plus digits “fit-4-u”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “HOSTINGER operations, UAB”+1 more
brand in the name “apple”lure words (login, verify, secure…) “id,wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “OwnRegistrar, Inc.”
brand spelled with digits “g00gle-test-qa-widget→google”many hyphens “3”brand plus digits “g00gle-test-qa-widget”brand name at a retail registrar “Wix.com Ltd.”
one-letter brand typo “mobile≈tmobile”brand plus digits “gavietsv388-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “google”lure words (login, verify, secure…) “verification”many hyphens “3”very long name “63”+2 more
brand in the name “google”TLD with a high abuse rate “work”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “google”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: Google), confidence 62%. An opinion, not a finding.
Highhoblox.xyzscore 55echoes roblox· placeholder page one-letter brand typo “hoblox≈roblox”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+2 more
Model opinion: looks like phishing (target: Roblox), confidence 87%. An opinion, not a finding.
brand in the name “shopify”many hyphens “3”very long name “30”brand plus digits “housetohome-8678-myshopify-com”+2 more
Model opinion: looks like abuse (target: Shopify), confidence 72%. An opinion, not a finding.
brand in the name “icloud”lure words (login, verify, secure…) “official”brand name at a retail registrar “Sav.com, LLC”brand name at a watch-list registrar “Sav.com, LLC”
brand in the name “google”lure words (login, verify, secure…) “claim,claims,portal”many hyphens “3”very long name “32”+2 more
one-letter brand typo “instragram≈instagram”brand name at a retail registrar “Tucows Domains Inc.”form on a brand-styled page “has_form”identical page on many newborns “41 identical pages”
Model opinion: looks like abuse (target: Instagram), confidence 72%. An opinion, not a finding.
brand in the name “airbnb”TLD with a high abuse rate “xyz”brand name at a retail registrar “Nics Telekomunikasyon A.S.”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
Highkraaken.xyzscore 55echoes kraken· blocked the probe one-letter brand typo “kraaken≈kraken”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+3 more
brand in the name “lineme”brand plus digits “lineme5296”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GNAME.COM PTE. LTD.”+1 more
brand in the name “lineme”brand plus digits “lineme5836”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GNAME.COM PTE. LTD.”+1 more
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 45%. An opinion, not a finding.
brand in the name “namecheap”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “sharepoint”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “strike≈stripe”lure words (login, verify, secure…) “win”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
Highmedcare.sbsscore 55echoes medicare· robots.txt denied one-letter brand typo “medcare≈medicare”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “medicare”lure words (login, verify, secure…) “official”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “etsy”brand name at a retail registrar “One.com”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “etsy”brand name at a retail registrar “One.com A/S”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand spelled with digits “micros0ftonline→microsoft”brand plus digits “micros0ftonline”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “adobe”many hyphens “3”very long name “32”brand plus digits “ms35778756675-adobe-views-review”+4 more
brand in the name “dropbox”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1375 identical pages”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “dropbox”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1375 identical pages”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “netflix”lure words (login, verify, secure…) “account”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “netflix”brand plus digits “netflixcas1no”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “DEVEXPANSE LTD d/b/a Regery.com”+1 more
brand in the name “office365”lure words (login, verify, secure…) “alert,security”brand plus digits “office365-security-alert”brand name at a retail registrar “Key-Systems GmbH”
one-letter brand typo “oflice365≈office365”brand plus digits “oflice365”brand name at a retail registrar “Ascio Technologies, Inc. Danmark - Filia”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Microsoft), confidence 80%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name on a rarely-seen nameserver “checkdomain.de”brand name at a retail registrar “Ascio Technologies, Inc. Danmark - Filia”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “itau”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”+1 more
brand in the name “revolut”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more
brand in the name “revolut”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more
brand in the name “revolut”many hyphens “3”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”+3 more
Model opinion: looks like abuse (target: Revolut), confidence 85%. An opinion, not a finding.
brand in the name “revolut”lure words (login, verify, secure…) “customer,customers,support”brand name at a retail registrar “Tucows Domains Inc.”
brand in the name “robinhood”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: looks like a scam, confidence 78%. An opinion, not a finding.
brand in the name “santander”brand plus digits “santanderal24”TLD with a high abuse rate “icu”brand name at a retail registrar “Gname.com Pte. Ltd.”+1 more
brand in the name “onedrive”lure words (login, verify, secure…) “secure”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more