brand in the name “facebook”lure words (login, verify, secure…) “update”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”
brand in the name “facebook”lure words (login, verify, secure…) “verify”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “facebook”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”+1 more
brand in the name “facebook”lure words (login, verify, secure…) “update”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”
brand in the name “fedex”lure words (login, verify, secure…) “delivery”brand name on a rarely-seen nameserver “hostingnigeria.com”
brand in the name “fedex”lure words (login, verify, secure…) “track,tracking”
brand in the name “fidelity”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+1 more
brand in the name “stripe”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
brand in the name “revolut”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “intuit”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”brand name redirects elsewhere “friscotimes.org”
Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “gmail365”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “39 identical pages”
Model opinion: looks like abuse (target: Google (Gmail)), confidence 76%. An opinion, not a finding.
brand in the name “gmail”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+2 more
brand in the name “google”lure words (login, verify, secure…) “support”
brand in the name “google”brand plus digits “googledownl0ad”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “google”TLD with a high abuse rate “top”brand name at a retail registrar “Dominet (HK) Limited”identical page on many newborns “331 identical pages”
Model opinion: looks like abuse (target: Google), confidence 68%. An opinion, not a finding.
brand in the name “google”very long name “32”brand plus digits “googlesharejhsdheb5ansfreeonline”TLD with a high abuse rate “icu”+1 more
brand in the name “tmobile”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “microsoft”lure words (login, verify, secure…) “secure”
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”
brand in the name “shopify”many hyphens “10”very long name “63”brand plus digits “https-admin-shopify-com-store-hyhr0q-2v-”+1 more
Model opinion: looks like abuse (target: Shopify), confidence 82%. An opinion, not a finding.
brand in the name “shopify”many hyphens “6”very long name “39”brand plus digits “https-admin-shopify-com-store-ud14kt-kc”+1 more
Model opinion: looks like phishing (target: Shopify), confidence 72%. An opinion, not a finding.
brand in the name “shopify”many hyphens “6”very long name “39”brand plus digits “https-admin-shopify-com-store-vzx7fz-hn”+2 more
Model opinion: looks like phishing (target: Shopify), confidence 72%. An opinion, not a finding.
brand in the name “hulu”brand name at a retail registrar “Nics Telekomunikasyon A.S.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 94%. An opinion, not a finding.
one-letter brand typo “icioud≈icloud”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”
brand in the name “icloud”lure words (login, verify, secure…) “help”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “intesa”brand plus digits “intesa365erix”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.
brand in the name “intuit”lure words (login, verify, secure…) “billing”
brand in the name “intuit”lure words (login, verify, secure…) “customer”brand name at a retail registrar “GoDaddy.com, LLC”
Model opinion: looks like abuse (target: Intuit), confidence 78%. An opinion, not a finding.
brand spelled with digits “it4u→itau”brand plus digits “it4u”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “tmobile”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “lineme”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “google”lure words (login, verify, secure…) “account,accounts”many hyphens “5”very long name “59”+3 more
Model opinion: looks like phishing (target: Google), confidence 92%. An opinion, not a finding.
brand in the name “lloyds”lure words (login, verify, secure…) “helpdesk”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “mobile≈tmobile”many hyphens “3”brand plus digits “lucky8-app-mobile-france”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 56%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”many hyphens “3”very long name “28”brand plus digits “lucky8-application-mobile-fr”+3 more
Model opinion: looks like abuse (target: Lucky8 (casino)), confidence 60%. An opinion, not a finding.
brand in the name “apple”lure words (login, verify, secure…) “help”brand name behind Cloudflare “cloudflare.com”
brand spelled with digits “market3bay→ebay”brand plus digits “market3bay”form on a brand-styled page “has_form”identical page on many newborns “1218 identical pages”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “telegram”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
one-letter brand typo “mobile≈tmobile”brand plus digits “megawin88-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand spelled with digits “mpo555team→steam”brand plus digits “mpo555team”TLD with a high abuse rate “xyz”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “telegram”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Gname.com Pte. Ltd.”+1 more
brand in the name “natwest”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”
brand in the name “netflix”very long name “29”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Model opinion: looks like phishing (target: Netflix), confidence 72%. An opinion, not a finding.
brand in the name “google”very long name “36”brand plus digits “new-ogb5b9a346293a707nvoic-googledoc”TLD with a high abuse rate “icu”+3 more
brand spelled with digits “niceokt4→okta”brand plus digits “niceokt4”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “nintendo”brand name at a retail registrar “Namify Domains Inc”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 58%. An opinion, not a finding.
brand in the name “zelle”TLD with a high abuse rate “autos”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
brand in the name “slack”brand name and brand-styled page “slack”form on a brand-styled page “has_form”
brand in the name “nvidia”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “nvidia”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”