Flagged newborn domains, Wednesday, September 2, 2026

2,506 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Mediumxn--wq0an4b.topscore 26· not probed yet
punycode name “脫缰 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--wq0az4b.topscore 26· no DNS
punycode name “脱缰 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--xbtq70b.topscore 26· not probed yet
punycode name “宥沐 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--xfr.topscore 26· blocked the probe
punycode name “功 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--xnu824a.topscore 26· not probed yet
punycode name “戒烟 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--xnuz35a.topscore 26· no DNS
punycode name “戒煙 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--yetu83a.topscore 26· no DNS
punycode name “小樅 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--yetw2y.topscore 26· active website
punycode name “小枞 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--yety46j.xyzscore 26· no web server
punycode name “小金 scripts=CJK”TLD with a high abuse rate “xyz”
punycode name “yg47o请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yg66j请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yg8wv请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “ygicx请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “ygpjn请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “ygraw请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “ygx69请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yh1xm请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yh65l请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yhc55请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yhcej请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yhki8请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yhogp请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yhtqn请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyq84l请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyq9ax请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqc8m请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqj00请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqlc6请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqngp请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
punycode name “yyqrcq请使用wifi访问 scripts=CJK/LATIN”TLD with a high abuse rate “xyz”
Mediumxn--z0q322b.topscore 26· no DNS
punycode name “憂傷 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--z22a19k.topscore 26· no DNS
punycode name “酒詩 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--zf0a50cn4l.topscore 26· no DNS
punycode name “老表網 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--zovo06c.xyzscore 26· no DNS
punycode name “最美 scripts=CJK”TLD with a high abuse rate “xyz”
Mediumxn--zssr9t.topscore 26· not probed yet
punycode name “拥失 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--zssx2y.topscore 26· no DNS
punycode name “擁失 scripts=CJK”TLD with a high abuse rate “top”
Mediumxn--zttr0p.topscore 26· boilerplate page
punycode name “明帝 scripts=CJK”TLD with a high abuse rate “top”
Mediumzatesla-invest.icuscore 26· active website
TLD with a high abuse rate “icu”form on a brand-styled page “has_form”
Medium5gk9w2c7m1x8q4v0rd.livescore 25· blocked the probe
random-looking name “H=4.17”brand in page title, not in the name “cloudflare”
Mediumcipit88an.comscore 25· no DNS
nameserver domain born the same day “cepealpns.com”
Mediumcipit88ap.comscore 25
nameserver domain born the same day “cepealpns.com”
Mediumcipit88bh.comscore 25
nameserver domain born the same day “cepealpns.com”
Mediumcipit88epic.comscore 25
nameserver domain born the same day “cepealpns.com”
Mediumcipit88j.comscore 25
nameserver domain born the same day “cepealpns.com”
Mediumcipit88top.comscore 25
nameserver domain born the same day “cepealpns.com”
Mediumcipit88us.comscore 25
nameserver domain born the same day “cepealpns.com”
Mediumcipit88web.comscore 25
nameserver domain born the same day “cepealpns.com”
Mediumd8k2y5p1n7z4h9v3bt.livescore 25· blocked the probe
random-looking name “H=4.17”brand in page title, not in the name “cloudflare”
Mediumfinancialmortgageplanning.infoscore 25· active website
nameserver domain born the same day “allfinancialinsupport.com”
Mediumn3z6p1h8y5t0b7j2fa.livescore 25· blocked the probe
random-looking name “H=4.17”brand in page title, not in the name “cloudflare”

Same data as JSON: /api/zone/risk?day=2026-09-02&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.