Flagged newborn domains, Saturday, September 5, 2026

20 names at tier medium or above in .cfd, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalcaixabalnk.cfdscore 70echoes caixabank· active website
one-letter brand typocaixabalnk≈caixabankTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarGlobal Domain Group LLC+1 more

Model opinion: looks like phishing (target: CaixaBank), confidence 95%. An opinion, not a finding.

Highamazoncadref.cfdscore 55echoes amazon· robots.txt denied
brand in the nameamazonTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLC+1 more

Model opinion: suspicious (target: Amazon), confidence 72%. An opinion, not a finding.

Highbeicloud.cfdscore 55echoes icloud· empty page
brand in the nameicloudTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Inc+1 more

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Highdocsign.cfdscore 55echoes docusign· no web server
one-letter brand typodocsign≈docusignTLD with a high abuse ratecfdbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLC+1 more

Model opinion: suspicious (target: DocuSign), confidence 60%. An opinion, not a finding.

Highgo2walmart.cfdscore 55echoes walmart· placeholder page
brand in the namewalmartbrand plus digitsgo2walmartTLD with a high abuse ratecfdbrand name on a rarely-seen nameserverprivatesystems.net+2 more

Model opinion: looks like abuse (target: Walmart), confidence 72%. An opinion, not a finding.

High21chhck0rd3r45532357895.cfdscore 51· redirects elsewhere
random-looking nameH=3.62TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 62%. An opinion, not a finding.

Highykkcloud.cfdscore 50· active website
TLD with a high abuse ratecfdpage impersonates a brandNetflixbrand in page title, not in the namenetflix
Highalexapi91.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highanapi12.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highapisave.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highid5248571.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highid98459251.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Highswsmngmtw.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Hightugnder.cfdscore 46· redirects elsewhere
TLD with a high abuse ratecfdbrand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumccuevana2.cfdscore 30· active website
TLD with a high abuse ratecfdpage impersonates a brandNetflix
Mediumzongyunti.cfdscore 30· active website
TLD with a high abuse ratecfdpage impersonates a brandNetflix
Mediumcaaixabalnnk.cfdscore 28· active website
TLD with a high abuse ratecfdbrand in page title, not in the namecaixabank
Mediumevitedashboard.cfdscore 28· active website
TLD with a high abuse ratecfdbrand in page title, not in the namenamecheap
Mediumhelsna.cfdscore 28· blocked the probe
TLD with a high abuse ratecfdbrand in page title, not in the namecloudflare
Mediumshipment-confirmation.cfdscore 26· active website
lure words (login, verify, secure…)confirm,confirmation,shipmentTLD with a high abuse ratecfd

Same data as JSON: /api/zone/risk?day=2026-09-05&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.