Flagged newborn domains, Sunday, September 6, 2026

27 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticaldocusigner.onlinescore 100echoes docusign· active website
brand in the namedocusignpage asks for credentialsSign in to your accountbrand name and brand-styled pagedocusignform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalvanguardnet.appscore 100echoes vanguard· active website
brand in the namevanguardbrand name on a rarely-seen nameservershockhosting.compage asks for credentialsLog in to your accountbrand in page title, not in the namexbox

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalcashappweb.cashscore 81echoes cashapp· active website
brand in the namecashappbrand name behind Cloudflarecloudflare.compage asks for credentialsconfirm your payment

Model opinion: looks like phishing (target: Cash App (Block, Inc.)), confidence 82%. An opinion, not a finding.

Criticaltrustwalletinsurance.supportscore 80echoes trustwallet· active website
brand in the nametrustwalletlure words (login, verify, secure…)walletbrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Trust Wallet), confidence 82%. An opinion, not a finding.

Criticalforsakenroblox.wikiscore 77echoes roblox· active website
brand in the namerobloxbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.brand name and brand-styled pageroblox+1 more

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalrobinhoodpools.lolscore 77echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratelolbrand name behind Cloudflarecloudflare.combrand name and brand-styled pagerobinhood+1 more

Model opinion: suspicious (target: Robinhood), confidence 55%. An opinion, not a finding.

Criticaltiktok-rn.icuscore 77echoes tiktok· active website
brand in the nametiktokTLD with a high abuse rateicubrand name behind Cloudflarecloudflare.combrand name and brand-styled pagetiktok+1 more

Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.

Criticaljustacoinonrobinhood.funscore 75echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratefunpage impersonates a brandcoinbasebrand name and brand-styled pagerobinhood

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalopenaione1.vipscore 70echoes openai· active website
brand in the nameopenaibrand plus digitsopenaione1brand name at a retail registrarGname.com Pte. Ltd.brand name at a watch-list registrarGname.com Pte. Ltd.+1 more

Model opinion: looks like a scam (target: OpenAI), confidence 85%. An opinion, not a finding.

Criticallaststoproblox.wikiscore 69echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name and brand-styled pagerobloxform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Criticaltiktoksignal.comscore 69echoes tiktok· active website
brand in the nametiktokbrand name behind Cloudflarecloudflare.combrand name and brand-styled pagetiktokform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Criticalchatgptbd.onlinescore 68echoes chatgpt· active website
brand in the namechatgptbrand in page title, not in the nameopenaiform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: OpenAI), confidence 93%. An opinion, not a finding.

Criticalrobloxcheaty.onlinescore 65echoes roblox· active website
brand in the namerobloxbrand name on a rarely-seen nameservermydevil.netbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: looks like abuse (target: Roblox), confidence 78%. An opinion, not a finding.

Criticaltiktoksavvy.appscore 63echoes tiktok· active website
brand in the nametiktokbrand name and brand-styled pagetiktokform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalvanguardsoft.appscore 63echoes vanguard· active website
brand in the namevanguardbrand name and brand-styled pagevanguardform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalvnroblox.shopscore 63echoes roblox· active website
brand in the namerobloxbrand name and brand-styled pagerobloxform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: Roblox), confidence 62%. An opinion, not a finding.

Criticalarsenaltiktok.sitescore 62echoes tiktok· active website
brand in the nametiktokbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalchatqpt.storescore 62echoes chatgpt· active website
one-letter brand typochatqpt≈chatgptbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.brand in page title, not in the namechatgpt

Model opinion: looks like phishing (target: OpenAI (ChatGPT)), confidence 70%. An opinion, not a finding.

Criticalopenaione.vipscore 62echoes openai· active website
brand in the nameopenaibrand name at a retail registrarGname.com Pte. Ltd.brand name at a watch-list registrarGname.com Pte. Ltd.form on a brand-styled pagehas_form

Model opinion: looks like a scam (target: OpenAI), confidence 82%. An opinion, not a finding.

Criticalsplicebay.comscore 62echoes ebay· active website
brand in the nameebaybrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.form on a brand-styled pagehas_form

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalxboxx.shopscore 62echoes xbox· active website
brand in the namexboxbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalalgonests.proscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namewhatsappform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticaldocomiru.onlinescore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalmobile-erp.appscore 60echoes tmobile· active website
one-letter brand typomobile≈tmobilebrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticalstrongtv.onlinescore 60· active website
page impersonates a brandAmazon Primebrand in page title, not in the nameappleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 93%. An opinion, not a finding.

Criticalvaleska.studioscore 60· active website
page impersonates a brandDHLbrand in page title, not in the namecommerzbankform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalyespron.onlinescore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-06&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.