Flagged newborn domains, Saturday, September 5, 2026

50 names at tier medium or above in .site, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalingresseroblox.sitescore 71echoes roblox· active website
brand in the namerobloxbrand name at a retail registrarName.com, Inc.brand name and brand-styled pagerobloxform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Ingresse (Brazilian ticketing platform) / Roblox), confidence 90%. An opinion, not a finding.

Criticalpagamentos-mercadopago.sitescore 62echoes mercadopago· active website
brand in the namemercadopagobrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Mercado Pago), confidence 93%. An opinion, not a finding.

Highbankofamericaonly.sitescore 55echoes bankofamerica· blocked the probe
brand in the namebankofamericabrand name at a retail registrarGoDaddy.com, LLCform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Bank of America), confidence 82%. An opinion, not a finding.

Highjagged-peak-cloud-5b2d8e.sitescore 55echoes icloud· blocked the probe
one-letter brand typocloud≈icloudmany hyphens3brand plus digitsjagged-peak-cloud-5b2d8ebrand name behind Cloudflarecloudflare.com+2 more

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Highquickbooksintuit.sitescore 54echoes intuit· registrar placeholder
brand in the nameintuitbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.identical page on many newborns5137 identical pages

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Highmobile-gopay777.sitescore 50echoes tmobile· parked, for sale
one-letter brand typomobile≈tmobilebrand plus digitsmobile-gopay777brand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Highstatusbroker-finance.sitescore 46echoes binance· boilerplate page
one-letter brand typofinance≈binancebrand name at a retail registrarPDR Ltd. d/b/a PublicDomainRegistry.comidentical page on many newborns22 identical pages

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Hightelegrammatka.sitescore 44echoes telegram· robots.txt denied
brand in the nametelegrambrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB
Mediumarcfinance.sitescore 38· active website
brand in page title, not in the namerobinhoodform on a brand-styled pagehas_form
Mediumatacadaomadeiras.sitescore 38· active website
brand in page title, not in the namewhatsappform on a brand-styled pagehas_form
Mediumdhananjoyagency.sitescore 38· active website
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumfdpresencadigital.sitescore 38· active website
brand in page title, not in the namewhatsappform on a brand-styled pagehas_form
Mediumkitchencove.sitescore 38· active website
brand in page title, not in the nameamazonform on a brand-styled pagehas_form
Mediumkitchensage.sitescore 38· active website
brand in page title, not in the nameamazonform on a brand-styled pagehas_form
Mediumlumina-mabes369.sitescore 38· active website
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediummahsinagency.sitescore 38· active website
brand in page title, not in the nameshopifyform on a brand-styled pagehas_form
Mediumnexora-mabes369.sitescore 38· active website
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumnovopedido.sitescore 38· redirects elsewhere
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumorbitmedia.sitescore 38· redirects elsewhere
brand in page title, not in the namenationwideform on a brand-styled pagehas_form
Mediumplanarc.sitescore 38· active website
brand in page title, not in the namewhatsappform on a brand-styled pagehas_form
Mediumredrop.sitescore 38· suspended
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumswitch-nsp.sitescore 38· active website
brand in page title, not in the namenintendoform on a brand-styled pagehas_form
Mediumtiktokpay.sitescore 38echoes tiktok· parked with ads
brand in the nametiktokbrand name at a retail registrarGandi SAS
Mediumtoolefo.sitescore 38· active website
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumvortex-mabes369.sitescore 38· active website
brand in page title, not in the namegoogleform on a brand-styled pagehas_form
Mediumwordpresstestdomain.sitescore 38echoes wordpress· no web server
brand in the namewordpressbrand name at a retail registrarTurkticaret.net Yazılım Hizmetleri Sanay
Mediumblnance.sitescore 36echoes binance· no DNS
one-letter brand typoblnance≈binancebrand name at a retail registrareNom, LLC
Mediummarshmallow-cloud.sitescore 36echoes icloud· no DNS
one-letter brand typocloud≈icloudbrand name at a retail registrarGMO Internet Group, Inc. d/b/a Onamae.co
Mediumyuge.sitescore 34· active website
page pushes urgent paymentCONGRATULATIONS YOUbrand in page title, not in the namerobinhood
Mediumppayrewards.sitescore 32· empty page
lure words (login, verify, secure…)reward,rewardsbrand in page title, not in the namepaypal
Mediumwinnergo-win.sitescore 32· blocked the probe
lure words (login, verify, secure…)win,winnerbrand in page title, not in the namecloudflare
Mediumauthenticreview.sitescore 30· registrar placeholder
brand in page title, not in the namehostingeridentical page on many newborns89 identical pages
Mediumavidrive.sitescore 30· active website
page asks for credentialsverify your account
Mediumcrimson-clover-meadow-6a4e8c.sitescore 30· blocked the probe
many hyphens3very long name28brand in page title, not in the namecloudflare
Mediummukurru.sitescore 30· active website
page asks for credentialsverify your identity
Mediummukuuru.sitescore 30· active website
page asks for credentialsverify your identity
Mediumorganizando.sitescore 30· registrar placeholder
brand in page title, not in the namehostingeridentical page on many newborns89 identical pages
Mediumplantify.sitescore 30· registrar placeholder
brand in page title, not in the namehostingeridentical page on many newborns89 identical pages
Mediumtsup.sitescore 30· active website
page asks for credentialsLog In to Account
Mediumviewlix.sitescore 30· active website
page asks for credentialsSign in to your account
Mediumxn--zf4bthp4bizebqcb2aca944l.sitescore 27· no DNS
punycode name이안스카이원서산 scripts=HANGULvery long name28random-looking nameH=3.85
Mediumancient-oak-whisper-3d7e9a.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare
Mediumblazing-sun-desert-8c2f1b.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare
Mediumdopaminetracker.sitescore 26· active website
lure words (login, verify, secure…)trackbrand in page title, not in the nameinstagram
Mediumdrifting-snow-flame-1b9d3f.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare
Mediumechoing-cave-stone-7f5e2a.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare
Mediumfrozen-lake-mirror-4c8a6d.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare
Mediumgentle-stream-brook-9e1b3c.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare
Mediumhidden-valley-mist-2a7d5f.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare
Mediumivy-covered-wall-6c9f4b.sitescore 26· blocked the probe
many hyphens3brand in page title, not in the namecloudflare

Same data as JSON: /api/zone/risk?day=2026-09-05&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.