brand in the name “paypal”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “google”many hyphens “3”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “kakao”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”
Model opinion: suspicious, confidence 65%. An opinion, not a finding.
TLD with a high abuse rate “lol”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”
Model opinion: looks like a scam, confidence 78%. An opinion, not a finding.
brand in the name “coinbase”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “bid”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “robinhood”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
one-letter brand typo “rodlox≈roblox”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
TLD with a high abuse rate “xyz”page impersonates a brand “Coinbase”brand in page title, not in the name “coinbase”
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
TLD with a high abuse rate “xyz”page impersonates a brand “Coinbase”brand in page title, not in the name “robinhood”
Model opinion: suspicious, confidence 65%. An opinion, not a finding.
brand in the name “starlink”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.
one-letter brand typo “sterling≈starling”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
one-letter brand typo “sterling≈starling”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
one-letter brand typo “sterling≈starling”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
one-letter brand typo “sterling≈starling”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
TLD with a high abuse rate “lol”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
TLD with a high abuse rate “fun”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”
Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “robinhood”
Model opinion: suspicious, confidence 65%. An opinion, not a finding.
brand in the name “tiktok”brand name on a rarely-seen nameserver “speedydns.net”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “tktok≈tiktok”TLD with a high abuse rate “autos”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Model opinion: suspicious, confidence 65%. An opinion, not a finding.
brand in the name “shopee”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “intuit”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1320 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “zelle”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “alipay”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more
Model opinion: looks like abuse (target: Alipay), confidence 76%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”many hyphens “3”brand name on a rarely-seen nameserver “awsdns-00.com”brand name at a retail registrar “Amazon Registrar, Inc.”
one-letter brand typo “cloud≈icloud”brand name on a rarely-seen nameserver “ntcloudhosting.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “barclays”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “5326 identical pages”
Model opinion: suspicious (target: Barclays), confidence 58%. An opinion, not a finding.
ambiguous brand word “apple”lure words (login, verify, secure…) “billing”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “5326 identical pages”
Model opinion: looks like abuse (target: Apple), confidence 72%. An opinion, not a finding.
one-letter brand typo “lcloud≈icloud”brand name on a rarely-seen nameserver “v1dnks.pro”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “chatgpt”brand name at a retail registrar “Register SPA”identical page on many newborns “92 identical pages”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “taobao”brand name at a retail registrar “Hefei Juming Network Technology Co., Ltd”identical page on many newborns “249 identical pages”
Model opinion: looks like abuse (target: Taobao), confidence 62%. An opinion, not a finding.
brand in the name “desjardins”very long name “29”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
brand in the name “ebay”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “5326 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “ebay”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “5326 identical pages”
one-letter brand typo “strike≈stripe”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “gmail”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “1520 identical pages”
Model opinion: suspicious (target: Gmail (Google)), confidence 58%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name on a rarely-seen nameserver “dns-suspended.com”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “google”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “5326 identical pages”
Model opinion: looks like abuse (target: Google), confidence 78%. An opinion, not a finding.
brand in the name “google”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “5326 identical pages”
Model opinion: looks like abuse (target: Google), confidence 72%. An opinion, not a finding.
brand in the name “hulu”brand name at a retail registrar “Hefei Juming Network Technology Co., Ltd”identical page on many newborns “249 identical pages”
Model opinion: suspicious, confidence 56%. An opinion, not a finding.
brand in the name “intuit”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “5326 identical pages”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “telegram”brand name at a retail registrar “Automattic Inc.”form on a brand-styled page “has_form”brand name redirects elsewhere “handwritingjobsparttime.online”
Model opinion: looks like a scam, confidence 86%. An opinion, not a finding.
one-letter brand typo “lcloud≈icloud”brand name on a rarely-seen nameserver “v1dnks.pro”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”