brand in the name “outlook”lure words (login, verify, secure…) “support”
brand in the name “whatsapp”lure words (login, verify, secure…) “support”
brand in the name “telegram”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “google”+2 more
Model opinion: looks like abuse (target: Telegram), confidence 72%. An opinion, not a finding.
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
brand in the name “tiktok”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “328 identical pages”+1 more
Model opinion: looks like abuse (target: TikTok), confidence 78%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “tiktoki18plus”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “trezor”lure words (login, verify, secure…) “support”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”
Model opinion: looks like abuse (target: Trust Wallet), confidence 82%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name on a rarely-seen nameserver “thcservers.com”
brand spelled with digits “tuition05→ionos”brand plus digits “tuition05”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Amazon Registrar, Inc.”
brand in the name “netflix”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”
brand in the name “vanguard”lure words (login, verify, secure…) “service,services”
one-letter brand typo “mobile≈tmobile”many hyphens “3”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+2 more
Model opinion: looks like abuse, confidence 70%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”many hyphens “3”brand plus digits “vip-mobile-deposit-slots1”brand name behind Cloudflare “cloudflare.com”+4 more
Model opinion: looks like abuse, confidence 68%. An opinion, not a finding.
one-letter brand typo “qcloud≈icloud”TLD with a high abuse rate “beauty”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “wallmart≈walmart”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Model opinion: looks like abuse (target: Walmart), confidence 78%. An opinion, not a finding.
brand in the name “walmart”lure words (login, verify, secure…) “prize”brand name behind Cloudflare “cloudflare.com”
brand in the name “walmart”lure words (login, verify, secure…) “giveaway”brand name behind Cloudflare “cloudflare.com”
brand in the name “westpac”lure words (login, verify, secure…) “support”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
one-letter brand typo “tripe≈stripe”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NAMECHEAP”+1 more
punycode name “autorisierungscodefürwordpress scripts=L”brand in the name “wordpress”very long name “30”identical page on many newborns “4137 identical pages”
Model opinion: looks like abuse (target: WordPress), confidence 78%. An opinion, not a finding.
punycode name “googleadscampañas scripts=LATIN”brand in the name “google”brand name at a retail registrar “GoDaddy.com, LLC”
one-letter brand typo “cloud≈icloud”many hyphens “5”very long name “31”brand plus digits “ym-low-cost-cloud-management-4e”+2 more
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand plus digits “1xbet171-mobile”TLD with a high abuse rate “top”identical page on many newborns “47 identical pages”
Model opinion: looks like abuse (target: 1xBet), confidence 72%. An opinion, not a finding.
brand in the name “amazon”very long name “29”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.
brand in the name “gmail”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”+1 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “hulu”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “1934 identical pages”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand in the name “hulu”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “1934 identical pages”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand in the name “hulu”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “1934 identical pages”
Model opinion: looks benign, confidence 78%. An opinion, not a finding.
brand in the name “hulu”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “1934 identical pages”
Model opinion: looks benign, confidence 70%. An opinion, not a finding.
brand in the name “intuit”TLD with a high abuse rate “quest”brand name at a retail registrar “Atom.com Domains LLC”brand name redirects elsewhere “atom.com”
Model opinion: looks benign, confidence 94%. An opinion, not a finding.
brand in the name “revolut”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “120 identical pages”brand name redirects elsewhere “wildcasino.ag”
Model opinion: looks like abuse (target: Revolut), confidence 82%. An opinion, not a finding.
brand in the name “natwest”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “1934 identical pages”
Model opinion: looks like abuse (target: NatWest Group), confidence 70%. An opinion, not a finding.
lure words (login, verify, secure…) “reward,rewards”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”
Model opinion: looks like a scam, confidence 87%. An opinion, not a finding.
lure words (login, verify, secure…) “reward,rewards”page impersonates a brand “Netflix”brand in page title, not in the name “amazon”
Model opinion: looks like a scam (target: YouTube), confidence 82%. An opinion, not a finding.
brand in the name “santander”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”identical page on many newborns “57 identical pages”
Model opinion: looks like abuse (target: Santander), confidence 78%. An opinion, not a finding.
brand in the name “shopify”many hyphens “3”very long name “32”brand name on a rarely-seen nameserver “awsdns-31.org”+1 more
one-letter brand typo “stride≈stripe”brand name at a retail registrar “Automattic Inc.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “support”
brand in the name “itau”lure words (login, verify, secure…) “access”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “xbox”brand plus digits “xboxtrc1”TLD with a high abuse rate “top”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “xfinity”brand name on a rarely-seen nameserver “hostbreak.com”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Xfinity (Comcast)), confidence 72%. An opinion, not a finding.
High87351a.comscore 53echoes tesla· boilerplate page brand spelled with digits “87351a→tesla”brand plus digits “87351a”identical page on many newborns “879 identical pages”
Model opinion: looks benign, confidence 82%. An opinion, not a finding.
brand in the name “playstation”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “playstation”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “gmail”brand name at a retail registrar “West263 International Limited”brand name and brand-styled page “gmail”
Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.
brand in the name “robinhood”TLD with a high abuse rate “fun”brand name and brand-styled page “robinhood”
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
brand in the name “coinbase”brand plus digits “114030coinbase”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
Model opinion: looks like abuse (target: Coinbase), confidence 76%. An opinion, not a finding.
brand in the name “kraken”brand plus digits “818393-kraken”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”