Flagged newborn domains, Saturday, September 5, 2026

104 names at tier low or above in .cfd, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalcaixabalnk.cfdscore 70echoes caixabank· active website
one-letter brand typocaixabalnk≈caixabankTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarGlobal Domain Group LLC+1 more

Model opinion: looks like phishing (target: CaixaBank), confidence 95%. An opinion, not a finding.

Highamazoncadref.cfdscore 55echoes amazon· robots.txt denied
brand in the nameamazonTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLC+1 more

Model opinion: suspicious (target: Amazon), confidence 72%. An opinion, not a finding.

Highbeicloud.cfdscore 55echoes icloud· empty page
brand in the nameicloudTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Inc+1 more

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Highdocsign.cfdscore 55echoes docusign· no web server
one-letter brand typodocsign≈docusignTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLC+1 more

Model opinion: suspicious (target: DocuSign), confidence 60%. An opinion, not a finding.

Highgo2walmart.cfdscore 55echoes walmart· placeholder page
brand in the namewalmartbrand plus digitsgo2walmartTLD with a high abuse ratecfdbrand name on a rarely-seen nameserverprivatesystems.net+2 more

Model opinion: looks like abuse (target: Walmart), confidence 72%. An opinion, not a finding.

High21chhck0rd3r45532357895.cfdscore 51· redirects elsewhere
random-looking nameH=3.62TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 62%. An opinion, not a finding.

Highykkcloud.cfdscore 50· active website
TLD with a high abuse ratecfdpage impersonates a brandNetflixbrand in page title, not in the namenetflix
Highalexapi91.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highanapi12.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highapisave.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highid5248571.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highid98459251.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highswsmngmtw.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Hightugnder.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumccuevana2.cfdscore 30· active website
TLD with a high abuse ratecfdpage impersonates a brandNetflix
Mediumzongyunti.cfdscore 30· active website
TLD with a high abuse ratecfdpage impersonates a brandNetflix
Mediumcaaixabalnnk.cfdscore 28· active website
TLD with a high abuse ratecfdbrand in page title, not in the namecaixabank
Mediumevitedashboard.cfdscore 28· active website
TLD with a high abuse ratecfdbrand in page title, not in the namenamecheap
Mediumhelsna.cfdscore 28· blocked the probe
TLD with a high abuse ratecfdbrand in page title, not in the namecloudflare
Mediumshipment-confirmation.cfdscore 26· active website
lure words (login, verify, secure…)confirm,confirmation,shipmentTLD with a high abuse ratecfd
Lowapple-hi.cfdscore 22echoes apple· boilerplate page
ambiguous brand wordappleTLD with a high abuse ratecfdidentical page on many newborns84 identical pages
Lowherototoperkasa.cfdscore 22· redirects elsewhere
TLD with a high abuse ratecfdlogin formhas_form+login words
Lowmembers-advantagefcu.cfdscore 20· no web server
lure words (login, verify, secure…)member,membersTLD with a high abuse ratecfd
Lowpayments-ricardo.cfdscore 20· no web server
lure words (login, verify, secure…)payment,paymentsTLD with a high abuse ratecfd
Lowchase-in.cfdscore 18echoes chase· empty page
ambiguous brand wordchaseTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.com
lure words (login, verify, secure…)bonusvery long name31TLD with a high abuse ratecfd
lure words (login, verify, secure…)bonusvery long name30TLD with a high abuse ratecfd
Lowdh-xlu-a01-fishscales831828a.cfdscore 18· boilerplate page
many hyphens3very long name28TLD with a high abuse ratecfd
Lowdh-xlu02-b-littlechili555316b2.cfdscore 18· boilerplate page
many hyphens3very long name30TLD with a high abuse ratecfd
Lowxlu-dh-a01-flyingfish981231a.cfdscore 18· boilerplate page
many hyphens3very long name28TLD with a high abuse ratecfd
Lowxlu-dh-c03-garlicsprouts981231c.cfdscore 18· boilerplate page
many hyphens3very long name31TLD with a high abuse ratecfd
Lowxlu-dh02-b-blacktigershrimp683236b2.cfdscore 18· boilerplate page
many hyphens3very long name35TLD with a high abuse ratecfd
Lowxlu-dh03-c-big-eyedfish683236c.cfdscore 18· boilerplate page
many hyphens4very long name30TLD with a high abuse ratecfd
very long name33random-looking nameH=3.86TLD with a high abuse ratecfd
Lowaeinpoat.cfdscore 16· boilerplate page
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowailube.cfdscore 16· robots.txt denied
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowavinpoat.cfdscore 16· boilerplate page
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowc-shorts.cfdscore 16· active website
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowdhlza.cfdscore 16· empty page
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowestonwest.cfdscore 16· robots.txt denied
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowfr-shorts.cfdscore 16· active website
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowguan-li.cfdscore 16· boilerplate page
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowm-bci.cfdscore 16· boilerplate page
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lownestpivot.cfdscore 16· robots.txt denied
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lownorc-part.cfdscore 16· boilerplate page
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Loworderdeposits1.cfdscore 16· robots.txt denied
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Loworderdeposits2.cfdscore 16· robots.txt denied
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Loworderdeposits3.cfdscore 16· robots.txt denied
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowpersonalm.cfdscore 16· active website
TLD with a high abuse ratecfdfree DNS providerdnsowl.com
Lowshortmovies.cfdscore 16· placeholder page
TLD with a high abuse ratecfdfree DNS providerdnsowl.com

Same data as JSON: /api/zone/risk?day=2026-09-05&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.