Flagged newborn domains, Sunday, September 13, 2026
1,996 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
punycode name “les-débarrasseurs-du-lubureon scripts=LA”many hyphens “3”very long name “29”
TLD with a high abuse rate “cfd”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “click”brand in page title, not in the name “telegram”
TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”
punycode name “ราคาคอนกรีตผสมเสร็จ scripts=THAI”very long name “34”random-looking name “H=4.09”
punycode name “安徽芜湖技师学院 scripts=CJK”very long name “29”random-looking name “H=4.06”
punycode name “肇庆市第二人民医院 scripts=CJK”very long name “32”random-looking name “H=3.96”
punycode name “ศูนย์รับสร้างบ้านสตูล scripts=THAI”very long name “36”random-looking name “H=3.93”
punycode name “마산한신더휴모델하우스 scripts=HANGUL”very long name “37”random-looking name “H=4.15”
punycode name “湖北省民族歌舞团 scripts=CJK”very long name “28”random-looking name “H=3.95”
punycode name “上海发展战略研究所 scripts=CJK”very long name “31”random-looking name “H=3.92”
punycode name “천안시출장마사지 scripts=HANGUL”very long name “29”random-looking name “H=4.18”
punycode name “인천시출장마사지 scripts=HANGUL”very long name “28”random-looking name “H=4.06”
punycode name “수원시출장마사지 scripts=HANGUL”very long name “28”random-looking name “H=4.24”
punycode name “화성시출장마사지 scripts=HANGUL”very long name “28”random-looking name “H=4.16”
punycode name “서울시출장마사지 scripts=HANGUL”very long name “28”random-looking name “H=3.95”
punycode name “성남시출장마사지 scripts=HANGUL”very long name “29”random-looking name “H=4.43”
punycode name “潮州市职业技术学校 scripts=CJK”very long name “33”random-looking name “H=4.20”
punycode name “江西艺术职业学院 scripts=CJK”very long name “30”random-looking name “H=4.09”
punycode name “대전시출장마사지 scripts=HANGUL”very long name “29”random-looking name “H=4.03”
punycode name “昱元機械工業有限公司 scripts=CJK”very long name “34”random-looking name “H=4.18”
lure words (login, verify, secure…) “account,portal,validation”TLD with a high abuse rate “top”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “billing”brand in page title, not in the name “google”
lure words (login, verify, secure…) “bonus”brand in page title, not in the name “playstation”
many hyphens “3”brand in page title, not in the name “cloudflare”
many hyphens “3”brand in page title, not in the name “cloudflare”
many hyphens “3”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “member”brand in page title, not in the name “gmail”
lure words (login, verify, secure…) “service”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “delivery”brand in page title, not in the name “whatsapp”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “booking”
many hyphens “3”very long name “29”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
lure words (login, verify, secure…) “login”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “login”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “login”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “work”form on a brand-styled page “has_form”
TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”page sells replica goods “REPLICA WATCH”
Same data as JSON: /api/zone/risk?day=2026-09-13&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.