Flagged newborn domains, Wednesday, September 2, 2026

9,056 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

punycode name “车贷计算器 scripts=CJK”random-looking name “H=3.73”
punycode name “でんわばんごうけんさく scripts=HIRAGANA”random-looking name “H=3.83”
Lowxn--q20b93bn3jn0if7fdzvexe.orgscore 23· no web server
punycode name “남성역헤르니티 scripts=HANGUL”random-looking name “H=3.89”
punycode name “성남맛집 scripts=HANGUL”random-looking name “H=3.77”
punycode name “世界稳定币 scripts=CJK”random-looking name “H=4.04”
punycode name “数游九州 scripts=CJK”random-looking name “H=3.64”
Lowxn--sy2bu7fgycxsiwwblwx.shopscore 23· boilerplate page
punycode name “클린정성비움 scripts=HANGUL”random-looking name “H=3.65”
Lowxn--v92b7yba204dtrgtuu.shopscore 23· boilerplate page
punycode name “법무법인승평 scripts=HANGUL”random-looking name “H=3.92”
Lowxn--vb0b35irzijta.shopscore 23· boilerplate page
punycode name “벽과바닥 scripts=HANGUL”random-looking name “H=3.64”
punycode name “영등포정형외과 scripts=HANGUL”random-looking name “H=3.94”
punycode name “인천항문외과 scripts=HANGUL”random-looking name “H=3.92”
Lowxn--vcs70dm67g41h.vipscore 23· redirects elsewhere
punycode name “奶龙国际 scripts=CJK”random-looking name “H=3.77”
punycode name “배방필하우스 scripts=HANGUL”random-looking name “H=3.88”
punycode name “海南农业网 scripts=CJK”random-looking name “H=3.79”
punycode name “세무대리 scripts=HANGUL”random-looking name “H=3.77”
Lowxn--vl2b29qk7blycgv2a.shopscore 23· boilerplate page
punycode name “이앤플러스 scripts=HANGUL”random-looking name “H=3.68”
Lowxn--w9jd5fw77m9jkmh1cbr2a.bizscore 23· boilerplate page
punycode name “会社売買ひろば scripts=CJK/HIRAGANA”random-looking name “H=4.09”
punycode name “广东省云标委 scripts=CJK”random-looking name “H=3.88”
Lowxn--yfrw1gow2d4chrxa.orgscore 23· server error
punycode name “轻蜂加速器 scripts=CJK”random-looking name “H=3.84”
punycode name “법원통합조회 scripts=HANGUL”random-looking name “H=4.01”
punycode name “リユースプランナー scripts=KATAKANA/KATAKANA-HIRA”random-looking name “H=3.61”
Lowxn--zf0b677an3an0j81j38k.orgscore 23· active website
punycode name “최우수상품권 scripts=HANGUL”random-looking name “H=3.70”
punycode name “한웅산업 scripts=HANGUL”random-looking name “H=3.62”
punycode name “心理服务 scripts=CJK”random-looking name “H=3.77”
Low10betsyorum.netscore 22echoes etsy
brand in the name “etsy”brand plus digits “10betsyorum”
Low123movieshub.xyzscore 22· active website
TLD with a high abuse rate “xyz”login form “has_form+login words”
Low1netsys.comscore 22echoes etsy
brand in the name “etsy”brand plus digits “1netsys”
Low755lol.winscore 22· active website
TLD with a high abuse rate “win”login form “has_form+login words”
Low8ou80.xyzscore 22· active website
TLD with a high abuse rate “xyz”login form “has_form+login words”
Lowalexgonzalezz.livescore 22· active website
page impersonates a brand “Binance”
Lowalkamil.clickscore 22· active website
TLD with a high abuse rate “click”login form “has_form+login words”
Lowallmovieshub.energyscore 22· active website
page impersonates a brand “Netflix”
Lowaltvera.onlinescore 22· active website
page impersonates a brand “Binance”
Lowamritamgh.techscore 22· active website
page impersonates a brand “Binance”
Lowanticoforno.livescore 22· active website
page impersonates a brand “Paypal”
Lowappleid-account.icuscore 22· robots.txt denied
lure words (login, verify, secure…) “account”TLD with a high abuse rate “icu”free DNS provider “dnsowl.com”
Lowapplicantportalacess.clickscore 22· redirects elsewhere
lure words (login, verify, secure…) “portal”TLD with a high abuse rate “click”free DNS provider “dnsowl.com”
Lowaqjdpr.datescore 22· active website
TLD with a high abuse rate “date”login form “has_form+login words”
Lowaraslot88bigwin.xyzscore 22· active website
TLD with a high abuse rate “xyz”login form “has_form+login words”
Lowarrflow.devscore 22· active website
page impersonates a brand “PayPal”
Lowbalkanfood.livescore 22· active website
page impersonates a brand “Paypal”
Lowbardi.topscore 22· active website
TLD with a high abuse rate “top”login form “has_form+login words”
Lowbarharbortea.proscore 22· active website
page impersonates a brand “USPS”
lure words (login, verify, secure…) “service,services,support”very long name “28”
Lowbcllub.momscore 22· redirects elsewhere
TLD with a high abuse rate “mom”login form “has_form+login words”
Lowbclubs.momscore 22· redirects elsewhere
TLD with a high abuse rate “mom”login form “has_form+login words”
lure words (login, verify, secure…) “service,services”many hyphens “3”very long name “31”
Lowbeirutpalace.livescore 22· active website
page impersonates a brand “Paypal”
Lowbestonlinepokiesnz.casinoscore 22· active website
page impersonates a brand “PayPal”
Lowbigislandcoffeeroasters.proscore 22· active website
page impersonates a brand “FEDEX”

Same data as JSON: /api/zone/risk?day=2026-09-02&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.