Flagged newborn domains, Monday, September 14, 2026
7,249 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “슬롯사이트 scripts=HANGUL”random-looking name “H=3.84”
punycode name “슬롯사이트 scripts=HANGUL”random-looking name “H=3.84”
punycode name “슬롯사이트 scripts=HANGUL”random-looking name “H=3.84”
punycode name “슬롯사이트 scripts=HANGUL”random-looking name “H=3.84”
punycode name “锦嵘健康 scripts=CJK”random-looking name “H=3.62”
punycode name “应无所住 scripts=CJK”random-looking name “H=3.64”
punycode name “不器用な人生 scripts=CJK/HIRAGANA”random-looking name “H=3.91”
punycode name “消防装备 scripts=CJK”random-looking name “H=3.64”
punycode name “인터넷수령조회 scripts=HANGUL”random-looking name “H=4.16”
punycode name “会社設立おすすめ scripts=CJK/HIRAGANA”random-looking name “H=3.94”
punycode name “주소모음 scripts=HANGUL”random-looking name “H=3.77”
punycode name “주소모음 scripts=HANGUL”random-looking name “H=3.77”
punycode name “주소모음 scripts=HANGUL”random-looking name “H=3.77”
punycode name “주소모음 scripts=HANGUL”random-looking name “H=3.77”
punycode name “주소모음 scripts=HANGUL”random-looking name “H=3.77”
punycode name “총판모아 scripts=HANGUL”random-looking name “H=3.64”
punycode name “安国药材 scripts=CJK”random-looking name “H=3.77”
punycode name “한방영양제 scripts=HANGUL”random-looking name “H=3.97”
punycode name “삼삼방역 scripts=HANGUL”random-looking name “H=3.66”
punycode name “供热产业园 scripts=CJK”random-looking name “H=4.00”
punycode name “甜蜜经济产业 scripts=CJK”random-looking name “H=4.02”
punycode name “中国绿色产业 scripts=CJK”random-looking name “H=3.83”
punycode name “保定供电 scripts=CJK”random-looking name “H=3.81”
punycode name “中国丝绸 scripts=CJK”random-looking name “H=3.91”
punycode name “奔步电脑 scripts=CJK”random-looking name “H=3.77”
many hyphens “5”very long name “36”random-looking name “H=3.98”TLD with a high abuse rate “top”
many hyphens “4”very long name “31”random-looking name “H=4.21”TLD with a high abuse rate “top”
brand in the name “revolut”brand plus digits “0thindustrialrevolution”
TLD with a high abuse rate “top”login form “has_form+login words”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “IRS”
page impersonates a brand “IRS”
TLD with a high abuse rate “sbs”login form “has_form+login words”
page impersonates a brand “USPS”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “Netflix”
TLD with a high abuse rate “xyz”login form “has_form+login words”
free DNS provider “dnsowl.com”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “USPs”
page impersonates a brand “Binance”
page impersonates a brand “Netflix”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “service,services,support”very long name “40”
many hyphens “3”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
page impersonates a brand “PayPal”
page impersonates a brand “PAYPAL”
Same data as JSON: /api/zone/risk?day=2026-09-14&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.