Flagged newborn domains, Friday, September 4, 2026

154 names at tier low or above in .icu, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalcdn1-ws-cloud.icuscore 64echoes icloud· active website
one-letter brand typocloud≈icloudbrand plus digitscdn1-ws-cloudTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.com+2 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalcdn2-ws-cloud.icuscore 64echoes icloud· active website
one-letter brand typocloud≈icloudbrand plus digitscdn2-ws-cloudTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.com+2 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highcdn-ws-cloud.icuscore 56echoes icloud· active website
one-letter brand typocloud≈icloudTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.combrand name at a retail registrarGname.com Pte. Ltd.+1 more

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Highamazon-canceltransaction.icuscore 55echoes amazon· robots.txt denied
brand in the nameamazonTLD with a high abuse rateicufree DNS providerdnsowl.combrand name at a retail registrarNameSilo, LLC+1 more
Highcdn-tg-cloud.icuscore 55echoes icloud· empty page
one-letter brand typocloud≈icloudTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.combrand name at a retail registrarGname.com Pte. Ltd.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Highdocusignne.icuscore 55echoes docusign· redirects elsewhere
brand in the namedocusignTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLC+3 more

Model opinion: looks like abuse (target: DocuSign), confidence 72%. An opinion, not a finding.

Highfidelity01.icuscore 55echoes fidelity· no DNS
brand in the namefidelitybrand plus digitsfidelity01TLD with a high abuse rateicubrand name at a retail registrarGname.com Pte. Ltd.+1 more
Hightiktokslot88aa.icuscore 54echoes tiktok· no web server
brand in the nametiktokbrand plus digitstiktokslot88aaTLD with a high abuse rateicubrand name at a retail registrarPDR Ltd. d/b/a PublicDomainRegistry.com
Highaerocenter.icuscore 46· active website
TLD with a high abuse rateicubrand in page title, not in the nametelegramform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Highcastodeilymory.icuscore 46· redirects elsewhere
TLD with a high abuse rateicubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Highdashboard-flarenetwork.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highfin-way.icuscore 46· active website
TLD with a high abuse rateicubrand in page title, not in the nametelegramform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.

Highflare-distribution.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highflarenetwork-dashboard.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highguncel-holiganbet2026.icuscore 46· redirects elsewhere
TLD with a high abuse rateicubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.

Highholiganbet2026-guncel.icuscore 46· redirects elsewhere
TLD with a high abuse rateicubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: suspicious (target: Google), confidence 75%. An opinion, not a finding.

Highpayton-ex.icuscore 46· active website
TLD with a high abuse rateicubrand in page title, not in the nametelegramform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Highthegioimmo.icuscore 46· active website
TLD with a high abuse rateicubrand in page title, not in the nameoutlookform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Hightkdropshipmall-admin.icuscore 46· active website
TLD with a high abuse rateicubrand in page title, not in the nametiktokform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: TikTok), confidence 93%. An opinion, not a finding.

Hightkdropshipmall-sales.icuscore 46· active website
TLD with a high abuse rateicubrand in page title, not in the nametiktokform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: TikTok), confidence 94%. An opinion, not a finding.

Hightxcvvof.icuscore 46· redirects elsewhere
TLD with a high abuse rateicubrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highxn--gncelgiris-9db.icuscore 46· blocked the probe
punycode namegüncelgiris scripts=LATINTLD with a high abuse rateicubrand in page title, not in the namecloudflare
Highzestprotocol-dasboard.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Highzigchain-app.icuscore 46· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflareform on a brand-styled pagehas_form
Mediumsignnrightdocument.icuscore 36· redirects elsewhere
TLD with a high abuse rateicufree DNS providerdnsowl.combrand in page title, not in the nameoutlook
Mediumjojobet-support-giris.icuscore 34· blocked the probe
lure words (login, verify, secure…)supportTLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumhehiyuv.icuscore 30· active website
TLD with a high abuse rateicupage impersonates a brandAmazon Prime
Medium365no.icuscore 28· server error
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumbetcio-slotpartner.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumbuvkene.icuscore 28· empty page
TLD with a high abuse rateicubrand in page title, not in the nametelegram
Mediumfriendbest.icuscore 28· other
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumgir-holiganbet.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumguncel-holiganbeta.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumkoldono.icuscore 28· empty page
TLD with a high abuse rateicubrand in page title, not in the nametelegram
Mediummatbet-amp32.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediummatbet-amp88.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediummatbet-amp99.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediummatbet-new.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediummatbettgiris.icuscore 28· active website
TLD with a high abuse rateicubrand in page title, not in the nametelegram
Mediumpolvobe.icuscore 28· empty page
TLD with a high abuse rateicubrand in page title, not in the nametelegram
Mediumsupertotobet-giris.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumsyopen.icuscore 28· other
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumtrangcacuocbongda.icuscore 28· server error
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumtrr-betcio.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumtwgamefan.icuscore 28· blocked the probe
TLD with a high abuse rateicubrand in page title, not in the namecloudflare
Mediumxn--1nrx6kyvrk7a.icuscore 26· no DNS
punycode name沟女去死 scripts=CJKTLD with a high abuse rateicu
Mediumxn--casibom-guncelyatrm-w5cb.icuscore 26· server error
punycode namecasibom-guncelyatırım scripts=LATINTLD with a high abuse rateicu
Mediumxn--grandpashabet-gncel-kbc.icuscore 26· no DNS
punycode namegrandpashabet-güncel scripts=LATINTLD with a high abuse rateicu
Lowbonus-zz.icuscore 22· robots.txt denied
lure words (login, verify, secure…)bonusTLD with a high abuse rateicufree DNS providerdnsowl.com
Lownatukusa-api.icuscore 22echoes usaa· no DNS
brand in the nameusaaTLD with a high abuse rateicu

Same data as JSON: /api/zone/risk?day=2026-09-04&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.