Flagged newborn domains, Tuesday, September 8, 2026

800 names at tier high or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalicloud-find1323.lifescore 84echoes icloud· active website
brand in the nameicloudbrand plus digitsicloud-find1323brand name behind Cloudflarecloudflare.compage impersonates a brandPayPal+1 more

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticalworkdayreset.shopscore 77echoes workday· active website
brand in the nameworkdaylure words (login, verify, secure…)resetbrand name behind Cloudflarecloudflare.combrand name and brand-styled pageworkday

Model opinion: looks benign, confidence 87%. An opinion, not a finding.

Criticalinstagramikeskus.wikiscore 70echoes instagram· active website
brand in the nameinstagrambrand name on a rarely-seen nameserverspeedydns.netbrand name at a retail registrarNameSilo, LLCbrand name at a watch-list registrarNameSilo, LLC+1 more

Model opinion: looks like abuse (target: Instagram), confidence 65%. An opinion, not a finding.

Criticalpiratebay.wtfscore 70echoes ebay· active website
brand in the nameebaypage impersonates a brandMicrosoft 365form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalbdtopsmm.comscore 68· active website
page asks for credentialsSign in to Your Accountbrand in page title, not in the namefacebookform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalhdhub4.xyzscore 68· active website
TLD with a high abuse ratexyzpage impersonates a brandnetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 94%. An opinion, not a finding.

Criticalteresamendoza.onlinescore 68· active website
page asks for credentialsSign in to your accountbrand in page title, not in the nametelegramform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaleverydaytrack.orgscore 66· active website
lure words (login, verify, secure…)trackpage impersonates a brandFedExbrand in page title, not in the nameamazonform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalnetflixvpn.clickscore 66echoes netflix· active website
brand in the namenetflixTLD with a high abuse rateclickbrand name behind Cloudflarecloudflare.compage impersonates a brandNetflix

Model opinion: looks like abuse (target: Netflix), confidence 72%. An opinion, not a finding.

Criticalsaberitsupport.comscore 66· active website
lure words (login, verify, secure…)supportpage impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticaluninswap.sitescore 66echoes uniswap· active website
one-letter brand typouninswap≈uniswapbrand in page title, not in the nameuniswapform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Uniswap), confidence 68%. An opinion, not a finding.

Criticalverilon.proscore 66echoes verizon· active website
one-letter brand typoverilon≈verizonbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalxizuho.worldscore 66echoes mizuho· active website
one-letter brand typoxizuho≈mizuhobrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: suspicious, confidence 48%. An opinion, not a finding.

Criticalanimediceroblox.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalreheadspleaseroblox.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalrobloxtheveil.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 87%. An opinion, not a finding.

Criticaljapan-3x1-tikktok.sbsscore 64echoes tiktok· active website
one-letter brand typotikktok≈tiktokbrand plus digitsjapan-3x1-tikktokTLD with a high abuse ratesbsbrand in page title, not in the nametiktok

Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.

Criticalbgd77-mobile.comscore 63echoes tmobile· active website
brand spelled with digitsbgd77-mobile→tmobilebrand plus digitsbgd77-mobilebrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalformation-chatgpt-ads.bizscore 63echoes chatgpt· active website
brand in the namechatgptbrand name and brand-styled pagechatgptform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalvanguardchill.sitescore 63echoes vanguard· active website
brand in the namevanguardbrand name and brand-styled pagevanguardform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalmonnshot-robinhood.topscore 62echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratetopbrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Moonshot / Robinhood), confidence 78%. An opinion, not a finding.

Criticalmp3tiktok.orgscore 62echoes tiktok· active website
brand in the nametiktokbrand plus digitsmp3tiktokbrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalsummitau.storescore 62echoes itau· active website
brand in the nameitaubrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 68%. An opinion, not a finding.

Criticalv9betmobile.comscore 62echoes tmobile· active website
brand in the nametmobilebrand plus digitsv9betmobilebrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalelvarnixtech.comscore 60· active website
page impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalemapanoramicstudio.infoscore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Criticalemusivemiraedev.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalfamiliarflow.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalflankerstream.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalfleshlixar.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalflynk.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalflypenyra.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticalmovieslot.shopscore 60· active website
page impersonates a brandNetFlixbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 96%. An opinion, not a finding.

Criticalnorthpointit.techscore 60· active website
page impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Criticalpaidfollowers.comscore 60· active website
page impersonates a brandBinancebrand in page title, not in the nameinstagramform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.

Criticalstarting-over.blogscore 60echoes starling· active website
one-letter brand typostarting≈starlingbrand name at a retail registrarPorkbun, LLCbrand name at a watch-list registrarPorkbun, LLCform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Highclarityaivanguard.sbsscore 59echoes vanguard· active website
brand in the namevanguardTLD with a high abuse ratesbsbrand name behind Cloudflarecloudflare.combrand name and brand-styled pagevanguard

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Highwalmartpalletyard.comscore 59echoes walmart· active website
brand in the namewalmartbrand name at a retail registrarPorkbun LLCbrand name at a watch-list registrarPorkbun LLCbrand name and brand-styled pagewalmart

Model opinion: looks like a scam (target: Walmart), confidence 89%. An opinion, not a finding.

Highinstagramcreators.onlinescore 58echoes instagram· active website
brand in the nameinstagramfree DNS providerdnsowl.combrand in page title, not in the namewordpress

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highnetflixvpn.orgscore 58echoes netflix· active website
brand in the namenetflixbrand name behind Cloudflarecloudflare.compage impersonates a brandNetflix

Model opinion: looks like abuse (target: Netflix), confidence 72%. An opinion, not a finding.

Highperpstock.funscore 58· active website
TLD with a high abuse ratefunfree DNS providerdnsowl.compage impersonates a brandCoinbasebrand in page title, not in the namerobinhood

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Highshakestock.xyzscore 58· active website
TLD with a high abuse ratexyzpage asks for credentialsverify your identitybrand in page title, not in the nameapple

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

Hightiktokimaailm.sitescore 58echoes tiktok· active website
brand in the nametiktokfree DNS providerdnsowl.combrand in page title, not in the namewordpress

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Highhinsgmail.orgscore 56echoes gmail· active website
brand in the namegmailbrand name at a retail registrarGoDaddy.com, LLCform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Highinstagramimaailm.sitescore 56echoes instagram· active website
brand in the nameinstagrambrand name on a rarely-seen nameserverspeedydns.netbrand in page title, not in the namewordpress

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highinstagraminipid.blogscore 56echoes instagram· active website
brand in the nameinstagrambrand name on a rarely-seen nameserverspeedydns.netbrand in page title, not in the namewordpress

Model opinion: looks like abuse (target: Instagram), confidence 60%. An opinion, not a finding.

Highinstagraminsights.infoscore 56echoes instagram· active website
brand in the nameinstagrambrand name on a rarely-seen nameserverspeedydns.netbrand in page title, not in the namewordpress

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highintuitioneats.appscore 56echoes intuit· active website
brand in the nameintuitbrand name at a retail registrarName.com, Inc.form on a brand-styled pagehas_form

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Highnamazon.storescore 56echoes amazon· active website
brand in the nameamazonbrand name at a retail registrarNetwork Solutions, LLCform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Hightiktokcreators.onlinescore 56echoes tiktok· active website
brand in the nametiktokbrand name on a rarely-seen nameserverspeedydns.netbrand in page title, not in the namewordpress

Model opinion: looks like abuse (target: TikTok), confidence 55%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-08&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.