Flagged newborn domains, Sunday, September 13, 2026
7,316 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
TLD with a high abuse rate “cfd”login form “has_form+login words”
TLD with a high abuse rate “sbs”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “Coinbase”
page impersonates a brand “PayPal”
page impersonates a brand “Coinbase”
page impersonates a brand “PayPal”
brand in the name “itau”TLD with a high abuse rate “xyz”
page impersonates a brand “Microsoft 365”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
TLD with a high abuse rate “work”login form “has_form+login words”
page impersonates a brand “PayPal”
punycode name “평택고덕수자인풍경채 scripts=HANGUL”very long name “34”
punycode name “超自然行动组官方网址 scripts=CJK”very long name “34”
punycode name “山天鋼建株式会社 scripts=CJK”very long name “30”
punycode name “강남구출장마사지 scripts=HANGUL”very long name “28”
punycode name “부천두산위브더제니스 scripts=HANGUL”very long name “33”
punycode name “新视界新闻博览台 scripts=CJK”very long name “28”
punycode name “无锡长江康复医院 scripts=CJK”very long name “29”
punycode name “espaçoceciliacoelhoterapeuta scripts=LAT”very long name “28”
punycode name “乐山市市中区卫生执法监督大队 scripts=CJK”very long name “45”
punycode name “韶关市公共资源交易中心 scripts=CJK”very long name “36”
punycode name “中国金属加工在线 scripts=CJK”very long name “29”
punycode name “内蒙古老干部活动中心 scripts=CJK”very long name “38”
punycode name “中国民航发展论坛 scripts=CJK”very long name “29”
punycode name “中国养殖商城平台 scripts=CJK”very long name “29”
punycode name “湖北省安全生产应急救援中心 scripts=CJK”very long name “43”
punycode name “中国国家画院美术馆 scripts=CJK”very long name “31”
punycode name “临床试验志愿者招募 scripts=CJK”very long name “33”
punycode name “misjaczystośćitransportdobrodzieńiokolic”very long name “41”
punycode name “창원한신더휴메가센텀대표홈페이지 scripts=HANGUL”very long name “52”
punycode name “한신더휴메가센텀창원 scripts=HANGUL”very long name “35”
punycode name “창원시한신더휴메가센텀 scripts=HANGUL”very long name “38”
punycode name “공식홈페이지방문상담예약 scripts=HANGUL”very long name “42”
punycode name “云南省综合评标专家库 scripts=CJK”very long name “36”
punycode name “포포코코키즈풀빌라 scripts=HANGUL”very long name “28”
punycode name “해링턴플레이스의정부역 scripts=HANGUL”very long name “38”
punycode name “肇庆市妇幼保健院 scripts=CJK”very long name “29”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
TLD with a high abuse rate “xyz”login form “has_form+login words”
TLD with a high abuse rate “xyz”login form “has_form+login words”
ambiguous brand word “kraken”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
brand in page title, not in the name “whatsapp”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
Same data as JSON: /api/zone/risk?day=2026-09-13&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.