Flagged newborn domains, Saturday, September 5, 2026

16 names at tier high or above in .app, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalstarlinkrastreio.appscore 71echoes starlink· active website
brand in the namestarlinkbrand name at a retail registrarName.com, Inc.brand name and brand-styled pagestarlinkform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Starlink (SpaceX)), confidence 93%. An opinion, not a finding.

Highvea-finance.appscore 55echoes binance· redirects elsewhere
one-letter brand typofinance≈binancebrand name behind Cloudflarecloudflare.combrand name at a retail registrarCloudFlare, Inc.brand in page title, not in the namecloudflare+2 more

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Highlinkedon.appscore 54echoes linkedin· blocked the probe
one-letter brand typolinkedon≈linkedinbrand name at a retail registrarGoDaddy.com, LLCform on a brand-styled pagehas_form

Model opinion: suspicious (target: LinkedIn), confidence 72%. An opinion, not a finding.

Highmilestracker.appscore 48· active website
lure words (login, verify, secure…)trackpage impersonates a brandIRSbrand in page title, not in the nameicloud

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Highfacebook-ads.appscore 44echoes facebook· no web server
brand in the namefacebookbrand name at a retail registrarDynadot LLC.brand name at a watch-list registrarDynadot LLC.
Hightiktokdown.appscore 44echoes tiktok· no DNS
brand in the nametiktokbrand name behind Cloudflarecloudflare.combrand name at a retail registrarCloudFlare, Inc.
Highvoltvanguard.appscore 44echoes vanguard· no web server
brand in the namevanguardbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDevexpanse Ltd
Highwhatsapp-web.appscore 44echoes whatsapp· no DNS
brand in the namewhatsappbrand name at a retail registrarGNAME.COM PTE. LTD.brand name at a watch-list registrarGNAME.COM PTE. LTD.
Highaegisquant.appscore 42· active website
page impersonates a brandBinancebrand in page title, not in the namebinance
Highbhav.appscore 42· active website
page impersonates a brandBinancebrand in page title, not in the namebinance
Highconfluxis.appscore 42· active website
page impersonates a brandPayPalbrand in page title, not in the nameshopify
Highkiovo.appscore 42· active website
page impersonates a brandNetflixbrand in page title, not in the namegmail
Highmonsteriptv.appscore 42· active website
page impersonates a brandNetflixbrand in page title, not in the namewhatsapp
Highmonstertv.appscore 42· active website
page impersonates a brandNetflixbrand in page title, not in the namewhatsapp
Highsowmorrow.appscore 42· active website
page impersonates a brandCoinbasebrand in page title, not in the namecoinbase
Hightaxsquid.appscore 42· active website
page impersonates a brandIRSbrand in page title, not in the nameebay

Same data as JSON: /api/zone/risk?day=2026-09-05&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.