Flagged newborn domains, Thursday, September 3, 2026

150 names at tier high or above in .xyz, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticallebger.xyzscore 94echoes ledger· active website
one-letter brand typolebger≈ledgerTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNICENIC INTERNATIONAL GROUP CO., LIMITED+3 more

Model opinion: looks like phishing (target: Ledger), confidence 97%. An opinion, not a finding.

Criticaltiktok88shop.xyzscore 72echoes tiktok· active website
brand in the nametiktokbrand plus digitstiktok88shopTLD with a high abuse ratexyzbrand name at a retail registrarGoDaddy.com, LLC+1 more

Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.

Criticalleumi-finance.xyzscore 68echoes binance· active website
one-letter brand typofinance≈binanceTLD with a high abuse ratexyzbrand name on a rarely-seen nameserverdnspodsag.combrand name at a retail registrarNicNames, Inc.+1 more

Model opinion: looks like phishing (target: Bank Leumi), confidence 97%. An opinion, not a finding.

Criticaloutlookreader.xyzscore 61echoes outlook· active website
brand in the nameoutlookTLD with a high abuse ratexyzbrand name at a retail registrarCV. Jogjacampbrand name and brand-styled pageoutlook

Model opinion: suspicious, confidence 0%. An opinion, not a finding.

Hightheworldofrobinhood.xyzscore 58echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name at a retail registrarHOSTINGER operations, UAB+1 more

Model opinion: looks like a scam (target: Robinhood), confidence 78%. An opinion, not a finding.

Highconvex-finance.xyzscore 55echoes binance· empty page
one-letter brand typofinance≈binanceTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNICENIC INTERNATIONAL GROUP CO., LIMITED+1 more

Model opinion: suspicious (target: Convex Finance), confidence 60%. An opinion, not a finding.

Highfffzhse9zpe84y.xyzscore 55echoes ebay· no web server
brand spelled with digitsfffzhse9zpe84y→ebaybrand plus digitsfffzhse9zpe84yTLD with a high abuse ratexyzbrand name at a retail registrarGoDaddy.com, LLC
Highfoundmy-cloud.xyzscore 55echoes icloud· redirects elsewhere
one-letter brand typocloud≈icloudTLD with a high abuse ratexyzbrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Inc+1 more

Model opinion: looks like phishing (target: Apple), confidence 70%. An opinion, not a finding.

Highthrustwallet.xyzscore 55echoes trustwallet· not probed yet
one-letter brand typothrustwallet≈trustwalletlure words (login, verify, secure…)walletTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highusaalertlabs.xyzscore 55echoes usaa· not probed yet
brand in the nameusaalure words (login, verify, secure…)alertTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highwalletsyogun.xyzscore 55echoes etsy· not probed yet
brand in the nameetsylure words (login, verify, secure…)walletTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highwordpress-tema.xyzscore 55echoes wordpress· registrar placeholder
brand in the namewordpressTLD with a high abuse ratexyzbrand name at a retail registrarNics Telekomunikasyon A.S.brand name and brand-styled pagewordpress+1 more

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highxn--yhsbcwifi-fd9n9724a4wscvuaj03i.xyzscore 55echoes hsbc· no DNS
punycode nameyhsbc请使用wifi访问 scripts=CJK/LATINbrand in the namehsbcTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.com+2 more
Highmedicloud.xyzscore 54echoes icloud· parked, for sale
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGoDaddy.com, LLCbrand name redirects elsewhereatom.com

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Hightelegram3.xyzscore 54echoes telegram· not probed yet
brand in the nametelegrambrand plus digitstelegram3TLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highusps9.xyzscore 54echoes usps· not probed yet
brand in the nameuspsbrand plus digitsusps9TLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbraidroute.xyzscore 52· active website
TLD with a high abuse ratexyzbrand in page title, not in the namerobinhoodform on a brand-styled pagehas_formform submits over plain HTTPhttp://braidroute.xyz/

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Highfgshgebay.xyzscore 52echoes ebay· placeholder page
brand in the nameebayTLD with a high abuse ratexyzbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Highkermitthefrogrobinhood.xyzscore 52echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratexyzbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.

Model opinion: looks like a scam, confidence 68%. An opinion, not a finding.

Highkingofrobinhood.xyzscore 52echoes robinhood· empty page
brand in the namerobinhoodTLD with a high abuse ratexyzbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highwhatsappweba.xyzscore 52echoes whatsapp· no DNS
brand in the namewhatsappTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDNSPod, Inc.
Highhapoalim-finance.xyzscore 50echoes binance· no DNS
one-letter brand typofinance≈binanceTLD with a high abuse ratexyzbrand name on a rarely-seen nameserverdnspodsag.combrand name at a retail registrarNicNames, Inc.
High993722566.xyzscore 46· active website
TLD with a high abuse ratexyzbrand in page title, not in the namecloudflareform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highagricloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highaguicloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highaistripe.xyzscore 46echoes stripe· not probed yet
brand in the namestripeTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highaiwordpress.xyzscore 46echoes wordpress· not probed yet
brand in the namewordpressTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highakicloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highataricloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highaussicloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbagmail.xyzscore 46echoes gmail· not probed yet
brand in the namegmailTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbaidu-alipay.xyzscore 46echoes alipay· not probed yet
brand in the namealipayTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbangmail.xyzscore 46echoes gmail· not probed yet
brand in the namegmailTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbcgmail.xyzscore 46echoes gmail· not probed yet
brand in the namegmailTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbcicloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbe-xbox.xyzscore 46echoes xbox· not probed yet
brand in the namexboxTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highberricloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highbitstripe.xyzscore 46echoes stripe· not probed yet
brand in the namestripeTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highblockstripe.xyzscore 46echoes stripe· not probed yet
brand in the namestripeTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highcanadaposts.xyzscore 46echoes canadapost· not probed yet
brand in the namecanadapostTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highcandysplashmix.xyzscore 46· redirects elsewhere
TLD with a high abuse ratexyzbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Highccicicloud.xyzscore 46echoes icloud· not probed yet
brand in the nameicloudTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highciaonspy.xyzscore 46· active website
TLD with a high abuse ratexyzbrand in page title, not in the namerobinhoodform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Highcloudkinrb.xyzscore 46· active website
TLD with a high abuse ratexyzbrand in page title, not in the namerobinhoodform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.

Highcoinstripe.xyzscore 46echoes stripe· not probed yet
brand in the namestripeTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highcookoldbroker.xyzscore 46· active website
TLD with a high abuse ratexyzbrand in page title, not in the namerobinhoodform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

Highdatacashapp.xyzscore 46echoes cashapp· not probed yet
brand in the namecashappTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highdelegmail.xyzscore 46echoes gmail· not probed yet
brand in the namegmailTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highdetoxbox.xyzscore 46echoes xbox· not probed yet
brand in the namexboxTLD with a high abuse ratexyzbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Highethfi-governance.xyzscore 46· blocked the probe
TLD with a high abuse ratexyzbrand in page title, not in the namecloudflareform on a brand-styled pagehas_form

Same data as JSON: /api/zone/risk?day=2026-09-03&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.