Flagged newborn domains, Wednesday, September 2, 2026

42 names at tier medium or above in .icu, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalmarsbahis-1mobile.icuscore 64echoes tmobile· active website
one-letter brand typo1mobile≈tmobilebrand plus digitsmarsbahis-1mobileTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.com+2 more

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

High4c-personal-finance.icuscore 55echoes binance· empty page
one-letter brand typofinance≈binancebrand plus digits4c-personal-financeTLD with a high abuse rateicubrand name at a retail registrarHOSTINGER operations, UAB+1 more

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Highsantanderal24.icuscore 55echoes santander· no DNS
brand in the namesantanderbrand plus digitssantanderal24TLD with a high abuse rateicubrand name at a retail registrarGname.com Pte. Ltd.+1 more
Highmarsbahis-telegramgiris1.icuscore 50echoes telegram· active website
brand in the nametelegrambrand plus digitsmarsbahis-telegramgiris1TLD with a high abuse rateicubrand name behind Cloudflarecloudflare.com+2 more

Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.

Highbetwildgir-adresleri.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highdarkmoney.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highfelix-protocol.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highfelixprotocol-distributions.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highholiganbetgunceli.icuscore 46· redirects elsewhere
TLD with a high abuse rateicubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 76%. An opinion, not a finding.

Highholiganbetguncelll.icuscore 46· redirects elsewhere
TLD with a high abuse rateicubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 76%. An opinion, not a finding.

Highjetbahis-vipgirisler4r.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highparibahis-kazancicintikla.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highramadabet-adresleri.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highsiofyp.icuscore 46· redirects elsewhere
TLD with a high abuse rateicubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highmarsbahis-telegramgiris.icuscore 42echoes telegram· active website
brand in the nametelegramTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Inc+1 more

Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.

Mediumkralbet-bonus.icuscore 34· blocked the probe
lure words (login, verify, secure…)bonusTLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumtestdomwolf.icuscore 33· boilerplate page
TLD with a high abuse rateicunameserver domain born the same daywolfns.com
Mediumvpnkl.icuscore 30· active website
TLD with a high abuse rateicupage impersonates a brandNetflix
Mediumxn--vuq80b7ow3dgc751h2jdnxlniayb91b373v5sfi80f.icuscore 30· redirects elsewhere
punycode name合肥芯创未来信息技术有限公司 scripts=CJKvery long name46TLD with a high abuse rateicu
Mediumartemisbet-2026mobilgiris.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumbetzulaburada-2026.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumbluarg-trade.icuscore 28· empty page
TLD with a high abuse rateicubrand in page title, not in the namefacebook
Mediumdamabet-adresleri.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumganyanbet-2026girisadresi.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumholiganbet-tekadresi22.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediuminstall-uphold-documents.icuscore 28· active website
TLD with a high abuse rateicubrand in page title, not in the namedocusign
Mediumjasminbet-2026girisadresi.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumkargabet-2026adres.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumkral-new.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumkralbet-geldi.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumkralbet-new.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediummars-bahis2026tr.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumsahabet-giris7.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumsecurity-meta.icuscore 28· active website
lure words (login, verify, secure…)securityTLD with a high abuse rateiculogin formhas_form+login words
Mediumsuperbetin-2026girisadresi.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumteosbet-hizligiristr.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumvinxaga.icuscore 28· empty page
TLD with a high abuse rateicubrand in page title, not in the nametelegram
Mediumzirvuco.icuscore 28· empty page
TLD with a high abuse rateicubrand in page title, not in the nametelegram
Mediumxn--48jq.icuscore 26· active website
punycode nameさそ scripts=HIRAGANATLD with a high abuse rateicu
Mediumxn--casibom-eyllgirisi-w6b.icuscore 26· empty page
punycode namecasibom-eylülgirisi scripts=LATINTLD with a high abuse rateicu
Mediumxn--grandbetting-hzlgiris-xgdc.icuscore 26· empty page
punycode namegrandbetting-hızlıgiris scripts=LATINTLD with a high abuse rateicu
Mediumzatesla-invest.icuscore 26· active website
TLD with a high abuse rateicuform on a brand-styled pagehas_form

Same data as JSON: /api/zone/risk?day=2026-09-02&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.