Flagged newborn domains, Sunday, September 13, 2026

29 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalecloud-ai.topscore 76echoes icloud· active website
one-letter brand typoecloud≈icloudTLD with a high abuse ratetopfree DNS providerdnsowl.combrand name at a retail registrarNameSilo,LLC+2 more

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalsothebystion.topscore 74· active website
TLD with a high abuse ratetoppage asks for credentialsSign In To Your Accountpage impersonates a brandPayPallogin formhas_form+login words

Model opinion: looks like phishing (target: Sotheby's), confidence 93%. An opinion, not a finding.

Criticalsothebysweb.topscore 74· active website
TLD with a high abuse ratetoppage asks for credentialsSign In To Your Accountpage impersonates a brandPayPallogin formhas_form+login words

Model opinion: looks like phishing (target: Sotheby's), confidence 94%. An opinion, not a finding.

Criticalgoogledownl0ad.storescore 73echoes google· active website
brand in the namegooglebrand plus digitsgoogledownl0adbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameSilo, LLC+2 more

Model opinion: looks like abuse (target: Google Play), confidence 93%. An opinion, not a finding.

Criticalspotily.shopscore 72echoes spotify· active website
one-letter brand typospotily≈spotifybrand name behind Cloudflarecloudflare.combrand in page title, not in the namespotifyform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: Spotify), confidence 78%. An opinion, not a finding.

Criticaltelegramsearch.proscore 69echoes telegram· active website
brand in the nametelegrambrand name behind Cloudflarecloudflare.combrand name and brand-styled pagetelegramform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 52%. An opinion, not a finding.

Criticalokarasmm.onlinescore 68· active website
page asks for credentialslog in to your accountbrand in page title, not in the namefacebookform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalwonderfish.appscore 68· active website
page asks for credentialsSign in to your accountbrand in page title, not in the namelinkedinform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalbetmen-temnyj-rycar-zetflix.clubscore 66echoes netflix· active website
one-letter brand typozetflix≈netflixmany hyphens3brand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticaljapan-finance.orgscore 66echoes binance· active website
one-letter brand typofinance≈binancebrand in page title, not in the namemizuhoform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Mizuho), confidence 78%. An opinion, not a finding.

Criticalamazondailysell.shopscore 63echoes amazon· active website
brand in the nameamazonbrand name and brand-styled pageamazonform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: Amazon), confidence 68%. An opinion, not a finding.

Criticalcollaboration-openai.techscore 63echoes openai· active website
brand in the nameopenaibrand name and brand-styled pageopenaiform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: OpenAI), confidence 62%. An opinion, not a finding.

Criticalspotifyapk.infoscore 63echoes spotify· active website
brand in the namespotifybrand name and brand-styled pagespotifyform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: Spotify), confidence 90%. An opinion, not a finding.

Criticalario-cloud.xyzscore 60echoes icloud· active website
one-letter brand typocloud≈icloudTLD with a high abuse ratexyzbrand name on a rarely-seen nameserveranymhost.idform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 58%. An opinion, not a finding.

Criticalbookink.datescore 60echoes booking· active website
one-letter brand typobookink≈bookingTLD with a high abuse ratedatebrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalgreen-leaf.storescore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalhdmovie2a.livescore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 95%. An opinion, not a finding.

Criticalizvne-zetflix.clubscore 60echoes netflix· active website
one-letter brand typozetflix≈netflixbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalkorol-talsy-zetflix.clubscore 60echoes netflix· active website
one-letter brand typozetflix≈netflixbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticaloundi.appscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalpremium-flow.comscore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalrekoup.appscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namezelleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalskstore.appscore 60· active website
page impersonates a brandAmazon Primebrand in page title, not in the namexboxform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticalukrytie-zetflix.clubscore 60echoes netflix· active website
one-letter brand typozetflix≈netflixbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalvedmak-zetflix.clubscore 60echoes netflix· active website
one-letter brand typozetflix≈netflixbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalvneshnie-otmeli-zetflix.clubscore 60echoes netflix· active website
one-letter brand typozetflix≈netflixbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 92%. An opinion, not a finding.

Criticalwbsl.onlinescore 60· active website
page impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Microsoft), confidence 82%. An opinion, not a finding.

Criticalxassor.comscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalyelloustoun-zetflix.clubscore 60echoes netflix· active website
one-letter brand typozetflix≈netflixbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-13&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.