brand in the name “cloudflare”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+2 more
Model opinion: looks like phishing (target: Cloudflare), confidence 92%. An opinion, not a finding.
Criticallebger.funscore 94echoes ledger· active website one-letter brand typo “lebger≈ledger”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more
Model opinion: looks like phishing (target: Ledger), confidence 96%. An opinion, not a finding.
Criticallebger.topscore 94echoes ledger· active website one-letter brand typo “lebger≈ledger”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more
Model opinion: looks like phishing (target: Ledger), confidence 96%. An opinion, not a finding.
Criticallebger.xyzscore 94echoes ledger· active website one-letter brand typo “lebger≈ledger”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more
Model opinion: looks like phishing (target: Ledger), confidence 97%. An opinion, not a finding.
brand in the name “gmail”lure words (login, verify, secure…) “account”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “sitechai.com”+3 more
Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.
brand in the name “chatgpt”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+3 more
Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.
brand in the name “binance”TLD with a high abuse rate “fun”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+2 more
Model opinion: looks like a scam (target: Binance), confidence 93%. An opinion, not a finding.
brand in the name “paypal”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more
Model opinion: looks benign, confidence 65%. An opinion, not a finding.
one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-222-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more
Model opinion: looks like abuse (target: TikTok), confidence 91%. An opinion, not a finding.
one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-333-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more
Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.
one-letter brand typo “tikktok≈tiktok”brand plus digits “japan-44-tikktok”TLD with a high abuse rate “sbs”brand name at a retail registrar “NameCheap, Inc.”+2 more
Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.
brand in the name “fidelity”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “fidelity”+1 more
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “vanguard”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “vanguard”+1 more
Model opinion: suspicious, confidence 52%. An opinion, not a finding.
brand in the name “vanguard”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “vanguard”+1 more
Model opinion: looks benign, confidence 82%. An opinion, not a finding.
brand in the name “mercadopago”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+2 more
Model opinion: looks like abuse (target: Mercado Pago), confidence 68%. An opinion, not a finding.
page impersonates a brand “Coinbase”page pushes urgent payment “guaranteed returns”brand in page title, not in the name “coinbase”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Coinbase), confidence 94%. An opinion, not a finding.
one-letter brand typo “sterling≈starling”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+2 more
Model opinion: looks like a scam, confidence 92%. An opinion, not a finding.
brand in the name “vanguard”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+2 more
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “costco”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”page pushes urgent payment “CLAIM YOUR REWARD”+1 more
Model opinion: looks like phishing (target: Costco), confidence 82%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “tiktok88shop”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”+1 more
Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.
brand in the name “playstation”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “playstation”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Sony PlayStation), confidence 72%. An opinion, not a finding.
brand in the name “slack”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”brand name at a watch-list registrar “Sav.com, LLC”+1 more
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
Criticalamix.topscore 68· active website TLD with a high abuse rate “top”page impersonates a brand “Apple ID”brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
TLD with a high abuse rate “sbs”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 95%. An opinion, not a finding.
one-letter brand typo “finance≈binance”TLD with a high abuse rate “xyz”brand name on a rarely-seen nameserver “dnspodsag.com”brand name at a retail registrar “NicNames, Inc.”+1 more
Model opinion: looks like phishing (target: Bank Leumi), confidence 97%. An opinion, not a finding.
brand in the name “stripe”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”brand name at a watch-list registrar “Sav.com, LLC”+1 more
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
brand in the name “revolut”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “URL Solutions, Inc.”+1 more
Model opinion: looks like abuse (target: Revolut), confidence 78%. An opinion, not a finding.
brand in the name “tiktok”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”+1 more
Model opinion: looks like phishing (target: TikTok), confidence 85%. An opinion, not a finding.
one-letter brand typo “artcom≈attcom”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
one-letter brand typo “sterling≈starling”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more
Model opinion: looks like a scam, confidence 90%. An opinion, not a finding.
brand in the name “lazada”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.
brand in the name “vanguard”many hyphens “3”very long name “32”brand name behind Cloudflare “cloudflare.com”+3 more
Model opinion: looks benign, confidence 82%. An opinion, not a finding.
brand in the name “vanguard”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “Alibaba Cloud Computing Ltd.”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd.”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
brand in the name “bestbuy”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Best Buy), confidence 85%. An opinion, not a finding.
brand in the name “etsy”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
brand in the name “usaa”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
brand in the name “google”TLD with a high abuse rate “top”brand name at a retail registrar “Dominet (HK) Limited”brand name and brand-styled page “google”
Model opinion: looks like abuse (target: Google), confidence 82%. An opinion, not a finding.
brand in the name “outlook”TLD with a high abuse rate “xyz”brand name at a retail registrar “CV. Jogjacamp”brand name and brand-styled page “outlook”
Model opinion: suspicious, confidence 0%. An opinion, not a finding.
brand in the name “venmo”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more
Model opinion: looks like a scam, confidence 93%. An opinion, not a finding.
page impersonates a brand “paypal”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.
page impersonates a brand “Microsoft 365”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 92%. An opinion, not a finding.
page impersonates a brand “Microsoft 365”brand in page title, not in the name “icloud”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
page impersonates a brand “Apple ID”brand in page title, not in the name “icloud”form on a brand-styled page “has_form”
Model opinion: suspicious (target: Apple), confidence 55%. An opinion, not a finding.
page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
page impersonates a brand “netflix”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 96%. An opinion, not a finding.
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Netflix), confidence 72%. An opinion, not a finding.