Flagged newborn domains, Sunday, September 6, 2026
11,067 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
brand in the name “itau”TLD with a high abuse rate “xyz”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “IRS”
page impersonates a brand “PayPal”
brand in the name “itau”TLD with a high abuse rate “xyz”
page impersonates a brand “Coinbase”
page impersonates a brand “Paypal”
page impersonates a brand “Paypal”
lure words (login, verify, secure…) “service,services”many hyphens “3”very long name “31”
free DNS provider “dnsowl.com”page pushes urgent payment “Claim your reward”
page impersonates a brand “Netflix”
lure words (login, verify, secure…) “verify”lure suffix “verifynow”TLD with a high abuse rate “cfd”
page impersonates a brand “PayPal”
brand in the name “itau”TLD with a high abuse rate “xyz”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “Paypal”
TLD with a high abuse rate “buzz”page pushes urgent payment “LIMITED TIME OFFER”
page impersonates a brand “PayPal”
punycode name “의성내고향흑마늘 scripts=HANGUL”very long name “29”
punycode name “양산유소년축구대회 scripts=HANGUL”very long name “33”
punycode name “그랜드리스보아마카오 scripts=HANGUL”very long name “35”
punycode name “향남역그로브스위첸 scripts=HANGUL”very long name “32”
punycode name “검단센트레빌그랑포레 scripts=HANGUL”very long name “35”
punycode name “福建省数字地震科普馆 scripts=CJK”very long name “36”
punycode name “direcciónoperacionesydesarrollo scripts=”very long name “31”
punycode name “즶깉뤉왘뜁웫욎뎤껰 scripts=HANGUL”very long name “31”
punycode name “中文说唱信息平台 scripts=CJK”very long name “29”
punycode name “insaninsanıngölgesindeyetişir scripts=LA”very long name “28”
punycode name “공주월송진아레히 scripts=HANGUL”very long name “30”
punycode name “시화공단공장부동산 scripts=HANGUL”very long name “33”
punycode name “카지노이기는전략 scripts=HANGUL”very long name “29”
punycode name “주식회사브레인치즈 scripts=HANGUL”very long name “32”
punycode name “청담르엘갤러리아부동산 scripts=HANGUL”very long name “38”
punycode name “갤러리아최신주소 scripts=HANGUL”very long name “29”
punycode name “섬김간호요양센터 scripts=HANGUL”very long name “31”
punycode name “unidadeducativafedericoproaño scripts=LA”very long name “29”
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”form submits over plain HTTP “http://yearnfor.top/”
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”form submits over plain HTTP “http://zorviva.top/”
random-looking name “H=3.83”TLD with a high abuse rate “lol”free DNS provider “dnsowl.com”
random-looking name “H=4.00”TLD with a high abuse rate “cfd”free DNS provider “dnsowl.com”
brand in page title, not in the name “namecheap”
brand in page title, not in the name “namecheap”
brand in page title, not in the name “booking”
brand in page title, not in the name “google”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
Same data as JSON: /api/zone/risk?day=2026-09-06&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.