Flagged newborn domains, Friday, September 4, 2026

41 names at tier high or above in .online, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticaladobereaderupgradingservices.onlinescore 100echoes adobe· active website
brand in the nameadobelure words (login, verify, secure…)service,servicesvery long name28brand name at a retail registrarNameCheap, Inc.+2 more

Model opinion: looks like abuse (target: Adobe), confidence 76%. An opinion, not a finding.

Criticalcoinbase-help.onlinescore 92echoes coinbase· active website
brand in the namecoinbaselure words (login, verify, secure…)helpbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB+1 more

Model opinion: looks like phishing (target: Coinbase), confidence 93%. An opinion, not a finding.

Criticaloneroblox.onlinescore 77echoes roblox· active website
brand in the namerobloxbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.brand name and brand-styled pageroblox+1 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalrobloxcat.onlinescore 76echoes roblox· active website
brand in the namerobloxbrand name at a retail registrarGoDaddy.com, LLCbrand in page title, not in the namerobinhoodform on a brand-styled pagehas_form

Model opinion: looks like a scam (target: Roblox), confidence 76%. An opinion, not a finding.

Criticalavipay-test.onlinescore 66echoes alipay· active website
one-letter brand typoavipay≈alipaybrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalinstagrams.onlinescore 62echoes instagram· active website
brand in the nameinstagrambrand name behind Cloudflarecloudflare.combrand name at a retail registrarCloudflare, Inc.form on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Instagram (Meta)), confidence 80%. An opinion, not a finding.

Criticalflixmart.onlinescore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.

Highvanguardcasino.onlinescore 59echoes vanguard· active website
brand in the namevanguardbrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Incbrand name and brand-styled pagevanguard

Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.

Highgooqle-live-get-instant-viewers.onlinescore 55echoes google· no DNS
one-letter brand typogooqle≈googlemany hyphens4very long name31brand name behind Cloudflarecloudflare.com+2 more
Highmicr050ft.onlinescore 55echoes microsoft· robots.txt denied
brand spelled with digitsmicr050ft→microsoftbrand plus digitsmicr050ftbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB
Highmicro5oft.onlinescore 55echoes microsoft· robots.txt denied
brand spelled with digitsmicro5oft→microsoftbrand plus digitsmicro5oftbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB
Highonedrivesecuredsendandreceivefiles.onlinescore 55echoes onedrive· no web server
brand in the nameonedrivelure words (login, verify, secure…)securevery long name34free DNS providerdnsowl.com+2 more
Highpaypalcustomerservice.onlinescore 55echoes paypal· empty page
brand in the namepaypallure words (login, verify, secure…)customer,customers,servicebrand name at a retail registrarGlobal Domain Group LLC
Highquickbooks-renewal-billing.onlinescore 55echoes quickbooks· no web server
brand in the namequickbookslure words (login, verify, secure…)billingbrand name at a retail registrarGoDaddy.com, LLC
Highquickbooks-subscription-billing.onlinescore 55echoes quickbooks· no web server
brand in the namequickbookslure words (login, verify, secure…)billingvery long name31brand name at a retail registrarGoDaddy.com, LLC
Highquickbookssubscription-billing.onlinescore 55echoes quickbooks· no web server
brand in the namequickbookslure words (login, verify, secure…)billingvery long name30brand name at a retail registrarGoDaddy.com, LLC
Highfidelityxchainplc.onlinescore 54echoes fidelity· registrar placeholder
brand in the namefidelitybrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.identical page on many newborns4352 identical pages

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Highkebaya4dholiday.onlinescore 54echoes ebay· active website
brand in the nameebaybrand plus digitskebaya4dholidaybrand name behind Cloudflarecloudflare.combrand name at a retail registrarPDR Ltd. d/b/a PublicDomainRegistry.com+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Highdocusign-pdf.onlinescore 50echoes docusign· blocked the probe
brand in the namedocusignbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLCbrand name at a watch-list registrarNameSilo, LLC
Highmercado-libre-ar.onlinescore 50echoes mercadolibre· no DNS
brand in the namemercadolibrebrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Inc
Highspinbit-au.onlinescore 50echoes itau· blocked the probe
brand in the nameitaubrand name behind Cloudflarecloudflare.combrand name at a retail registrarNICENIC INTERNATIONAL GROUP CO., LIMITEDbrand name at a watch-list registrarNICENIC INTERNATIONAL GROUP CO., LIMITED
Highteamlink.onlinescore 50· active website
page asks for credentialsVerify Your Identitybrand in page title, not in the namemicrosoft

Model opinion: looks like phishing (target: Microsoft), confidence 93%. An opinion, not a finding.

Highinstagramspotscuracao.onlinescore 48echoes instagram· boilerplate page
brand in the nameinstagrambrand name at a retail registrarHosting Concepts B.V. d/b/a Registrar.euidentical page on many newborns26 identical pages

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highkadr-cloud.onlinescore 48echoes icloud· active website
one-letter brand typocloud≈icloudbrand name on a rarely-seen nameserverturtleguard.cloudbrand name at a retail registrarPorkbun LLCbrand name at a watch-list registrarPorkbun LLC

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Hightiktokslot88aa.onlinescore 46echoes tiktok· no web server
brand in the nametiktokbrand plus digitstiktokslot88aabrand name at a retail registrarPDR Ltd. d/b/a PublicDomainRegistry.com
Highparish-booking.onlinescore 45echoes booking· active website
ambiguous brand wordbookingbrand name at a retail registrarName.com, Inc.brand name and brand-styled pagebookingform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highconectingwise.onlinescore 44· active website
page asks for credentialsSign in to your accountlogin formhas_form+login words

Model opinion: suspicious, confidence 65%. An opinion, not a finding.

Highgetjessan.onlinescore 44· active website
page asks for credentialsSign in to your accountlogin formhas_form+login words

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highrevolutioncasinoapp.onlinescore 44echoes revolut· empty page
brand in the namerevolutbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Highsparkasse-essen.onlinescore 44echoes sparkasse· robots.txt denied
brand in the namesparkassebrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB
Highsparkasse-offenburg.onlinescore 44echoes sparkasse· robots.txt denied
brand in the namesparkassebrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB
Highallinone-cloud.onlinescore 42echoes icloud· active website
one-letter brand typocloud≈icloudbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Highcloud-finops.onlinescore 42echoes icloud· no DNS
one-letter brand typocloud≈icloudbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.
Highdivn.onlinescore 42· active website
page impersonates a brandMetaMaskbrand in page title, not in the namerobinhood

Model opinion: looks like a scam, confidence 76%. An opinion, not a finding.

Highjosephmarler.onlinescore 42· active website
page impersonates a brandOffice 365brand in page title, not in the namemicrosoft
Highmycrosoft.onlinescore 42echoes microsoft· no DNS
one-letter brand typomycrosoft≈microsoftbrand name at a retail registrarAlibaba Cloud Computing Ltd. d/b/a HiChibrand name at a watch-list registrarAlibaba Cloud Computing Ltd. d/b/a HiChi
Highnexxt-finance.onlinescore 42echoes binance· empty page
one-letter brand typofinance≈binancebrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB
Highsiemens-mobile.onlinescore 42echoes tmobile· no DNS
one-letter brand typomobile≈tmobilebrand name behind Cloudflarecloudflare.combrand name at a retail registrarRegional Network Information Center, JSC
Highsms67.onlinescore 42· active website
page impersonates a brandPayPalbrand in page title, not in the namegoogle
Highsofi365.onlinescore 42· active website
page impersonates a brandBinancebrand in page title, not in the nametelegram
Highvaultxpay.onlinescore 42· active website
page impersonates a brandBinancebrand in page title, not in the namebinance

Same data as JSON: /api/zone/risk?day=2026-09-04&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.