Flagged newborn domains, Tuesday, September 8, 2026

36 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalicloud-find1323.lifescore 84echoes icloud· active website
brand in the nameicloudbrand plus digitsicloud-find1323brand name behind Cloudflarecloudflare.compage impersonates a brandPayPal+1 more

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticalworkdayreset.shopscore 77echoes workday· active website
brand in the nameworkdaylure words (login, verify, secure…)resetbrand name behind Cloudflarecloudflare.combrand name and brand-styled pageworkday

Model opinion: looks benign, confidence 87%. An opinion, not a finding.

Criticalinstagramikeskus.wikiscore 70echoes instagram· active website
brand in the nameinstagrambrand name on a rarely-seen nameserverspeedydns.netbrand name at a retail registrarNameSilo, LLCbrand name at a watch-list registrarNameSilo, LLC+1 more

Model opinion: looks like abuse (target: Instagram), confidence 65%. An opinion, not a finding.

Criticalpiratebay.wtfscore 70echoes ebay· active website
brand in the nameebaypage impersonates a brandMicrosoft 365form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalbdtopsmm.comscore 68· active website
page asks for credentialsSign in to Your Accountbrand in page title, not in the namefacebookform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalhdhub4.xyzscore 68· active website
TLD with a high abuse ratexyzpage impersonates a brandnetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 94%. An opinion, not a finding.

Criticalteresamendoza.onlinescore 68· active website
page asks for credentialsSign in to your accountbrand in page title, not in the nametelegramform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaleverydaytrack.orgscore 66· active website
lure words (login, verify, secure…)trackpage impersonates a brandFedExbrand in page title, not in the nameamazonform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalnetflixvpn.clickscore 66echoes netflix· active website
brand in the namenetflixTLD with a high abuse rateclickbrand name behind Cloudflarecloudflare.compage impersonates a brandNetflix

Model opinion: looks like abuse (target: Netflix), confidence 72%. An opinion, not a finding.

Criticalsaberitsupport.comscore 66· active website
lure words (login, verify, secure…)supportpage impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticaluninswap.sitescore 66echoes uniswap· active website
one-letter brand typouninswap≈uniswapbrand in page title, not in the nameuniswapform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Uniswap), confidence 68%. An opinion, not a finding.

Criticalverilon.proscore 66echoes verizon· active website
one-letter brand typoverilon≈verizonbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalxizuho.worldscore 66echoes mizuho· active website
one-letter brand typoxizuho≈mizuhobrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: suspicious, confidence 48%. An opinion, not a finding.

Criticalanimediceroblox.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalreheadspleaseroblox.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalrobloxtheveil.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 87%. An opinion, not a finding.

Criticaljapan-3x1-tikktok.sbsscore 64echoes tiktok· active website
one-letter brand typotikktok≈tiktokbrand plus digitsjapan-3x1-tikktokTLD with a high abuse ratesbsbrand in page title, not in the nametiktok

Model opinion: looks like abuse (target: TikTok), confidence 93%. An opinion, not a finding.

Criticalbgd77-mobile.comscore 63echoes tmobile· active website
brand spelled with digitsbgd77-mobile→tmobilebrand plus digitsbgd77-mobilebrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalformation-chatgpt-ads.bizscore 63echoes chatgpt· active website
brand in the namechatgptbrand name and brand-styled pagechatgptform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalvanguardchill.sitescore 63echoes vanguard· active website
brand in the namevanguardbrand name and brand-styled pagevanguardform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalmonnshot-robinhood.topscore 62echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratetopbrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Moonshot / Robinhood), confidence 78%. An opinion, not a finding.

Criticalmp3tiktok.orgscore 62echoes tiktok· active website
brand in the nametiktokbrand plus digitsmp3tiktokbrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalsummitau.storescore 62echoes itau· active website
brand in the nameitaubrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 68%. An opinion, not a finding.

Criticalv9betmobile.comscore 62echoes tmobile· active website
brand in the nametmobilebrand plus digitsv9betmobilebrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalelvarnixtech.comscore 60· active website
page impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalemapanoramicstudio.infoscore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Criticalemusivemiraedev.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalfamiliarflow.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalflankerstream.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalfleshlixar.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalflynk.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalflypenyra.clickscore 60· active website
TLD with a high abuse rateclickpage pushes urgent paymentRisk-Freebrand in page title, not in the namenationwideform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticalmovieslot.shopscore 60· active website
page impersonates a brandNetFlixbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 96%. An opinion, not a finding.

Criticalnorthpointit.techscore 60· active website
page impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Criticalpaidfollowers.comscore 60· active website
page impersonates a brandBinancebrand in page title, not in the nameinstagramform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.

Criticalstarting-over.blogscore 60echoes starling· active website
one-letter brand typostarting≈starlingbrand name at a retail registrarPorkbun, LLCbrand name at a watch-list registrarPorkbun, LLCform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 94%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-08&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.