Flagged newborn domains, Friday, September 4, 2026

12,463 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Lowxn--tl3b69e9on2pcqcezvwwc.comscore 23· redirects elsewhere
punycode name “유투벳평생주소 scripts=HANGUL”random-looking name “H=3.97”
punycode name “앙벳평생 scripts=HANGUL”random-looking name “H=3.77”
punycode name “벳위즈접속 scripts=HANGUL”random-looking name “H=3.79”
punycode name “维稳评估 scripts=CJK”random-looking name “H=3.64”
punycode name “法斯特体育 scripts=CJK”random-looking name “H=3.73”
punycode name “명성평생주소 scripts=HANGUL”random-looking name “H=4.12”
punycode name “모모평생주소 scripts=HANGUL”random-looking name “H=3.88”
punycode name “棋牌国际 scripts=CJK”random-looking name “H=3.75”
punycode name “뉴헤븐접속 scripts=HANGUL”random-looking name “H=3.68”
punycode name “다볼뉴스 scripts=HANGUL”random-looking name “H=3.66”
punycode name “에이블뉴스 scripts=HANGUL”random-looking name “H=3.95”
punycode name “四川工业铝型材 scripts=CJK”random-looking name “H=4.25”
punycode name “新零售产业 scripts=CJK”random-looking name “H=3.97”
punycode name “教育信息产业 scripts=CJK”random-looking name “H=4.01”
punycode name “益有实业 scripts=CJK”random-looking name “H=3.77”
punycode name “广西农业网商城 scripts=CJK”random-looking name “H=3.94”
punycode name “华夏茶业 scripts=CJK”random-looking name “H=3.64”
punycode name “에듀모닝 scripts=HANGUL”random-looking name “H=3.64”
punycode name “세호와유정 scripts=HANGUL”random-looking name “H=3.83”
punycode name “해병대특판 scripts=HANGUL”random-looking name “H=4.17”
punycode name “절대영어 scripts=HANGUL”random-looking name “H=3.88”
Lowxn--vk1bt5y22jehi.comscore 23· active website
punycode name “홍대셔츠 scripts=HANGUL”random-looking name “H=3.77”
Lowxn--vl2b25i22gpqaj05agob.comscore 23· active website
punycode name “러브연애코치 scripts=HANGUL”random-looking name “H=3.73”
punycode name “嘉州鑫盛源 scripts=CJK”random-looking name “H=3.84”
punycode name “凌龙纺织 scripts=CJK”random-looking name “H=3.70”
punycode name “斗门教育 scripts=CJK”random-looking name “H=3.66”
punycode name “德勤风险管理 scripts=CJK”random-looking name “H=3.79”
Lowxn--wlq122a88fd9bx80az20b.comscore 23· no DNS
punycode name “数字资产捐献 scripts=CJK”random-looking name “H=3.76”
punycode name “数字资产基金 scripts=CJK”random-looking name “H=3.92”
punycode name “金太阳制药机械 scripts=CJK”random-looking name “H=4.08”
punycode name “柔帛轩智纺 scripts=CJK”random-looking name “H=3.73”
punycode name “スマらく引越し scripts=CJK/HIRAGANA/KATAKANA”random-looking name “H=3.92”
punycode name “钣金加工平台 scripts=CJK”random-looking name “H=3.92”
Lowxn--yfrw1gx2klk4c7xo.orgscore 23· server error
punycode name “快鸭加速器 scripts=CJK”random-looking name “H=3.79”
punycode name “러버랩성수 scripts=HANGUL”random-looking name “H=3.97”
punycode name “쿠키상품권 scripts=HANGUL”random-looking name “H=3.83”
Lowxn--zf0bz1jfqyv3c8wj.shopscore 23· boilerplate page
punycode name “충효태권도 scripts=HANGUL”random-looking name “H=3.84”
punycode name “德勤财务咨询 scripts=CJK”random-looking name “H=3.72”
punycode name “신안피앤피 scripts=HANGUL”random-looking name “H=3.81”
Low99jiasucn.bizscore 22· active website
page impersonates a brand “Netflix”
Low99jiasucn.comscore 22· active website
page impersonates a brand “Netflix”
Lowabusaad.xyzscore 22echoes usaa· not probed yet
brand in the name “usaa”TLD with a high abuse rate “xyz”
lure words (login, verify, secure…) “access,customer,customers,service”very long name “29”
Lowadguardvpn.orgscore 22· active website
page impersonates a brand “Netflix”
Lowagentsfi.networkscore 22· active website
page impersonates a brand “Binance”
Lowaicloudspacesblueprint.comscore 22echoes icloud· no DNS
brand in the name “icloud”brand name at a retail registrar “Amazon Registrar, Inc.”
Lowaigoagme01.shopscore 22· active website
page impersonates a brand “MetaMask”
Lowailyu.bizscore 22· active website
page impersonates a brand “Netflix”
Lowamdp.clickscore 22· active website
TLD with a high abuse rate “click”login form “has_form+login words”
Lowantares2.onlinescore 22· active website
page impersonates a brand “BINANCE”

Same data as JSON: /api/zone/risk?day=2026-09-04&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.