Flagged newborn domains, Monday, September 14, 2026
7,249 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “verified”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
TLD with a high abuse rate “cam”login form “has_form+login words”
TLD with a high abuse rate “sbs”login form “has_form+login words”
page impersonates a brand “DHL”
page impersonates a brand “PayPal”
brand in the name “revolut”brand name redirects elsewhere “kellybrittonmetacognitivetherapy.com”
page impersonates a brand “IRS”
punycode name “อาหารลดน้ําหนัก scripts=THAI”very long name “28”
punycode name “สํานักงานกฎหมายไทย scripts=THAI”very long name “33”
punycode name “маммопластикатурция scripts=CYRILLIC”very long name “28”
punycode name “брахиопластикатурция scripts=CYRILLIC”very long name “30”
punycode name “послебариатрическаяхирургиятурция script”very long name “43”
punycode name “абдоминопластикатурция scripts=CYRILLIC”very long name “30”
punycode name “подтяжкабедертурция scripts=CYRILLIC”very long name “29”
punycode name “маммимейковертурция scripts=CYRILLIC”very long name “30”
punycode name “подтяжкагрудитурция scripts=CYRILLIC”very long name “29”
punycode name “уменьшениегрудитурция scripts=CYRILLIC”very long name “34”
punycode name “长春柏辰艺术中学 scripts=CJK”very long name “29”
punycode name “中国海域使用论证网 scripts=CJK”very long name “31”
punycode name “gestión-renovación-suscripción scripts=L”very long name “30”
punycode name “gislainealmeidaespaçodabeleza scripts=LA”very long name “29”
punycode name “エッセンシャルワーカー採用研究所 scripts=CJK/KATAKANA/KA”very long name “42”
punycode name “mersinfenerbahçevoleybolokulu scripts=LA”very long name “29”
punycode name “원주청년소상공인협회 scripts=HANGUL”very long name “35”
punycode name “법원등기간편검색 scripts=HANGUL”very long name “28”
punycode name “sternenhimmel-nachrüsten-berlin scripts=”very long name “31”
punycode name “贵州坤黔酒业有限公司 scripts=CJK”very long name “35”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
random-looking name “H=3.81”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “linkedin”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “godaddy”
brand in page title, not in the name “facebook”
brand in page title, not in the name “wordpress”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “wordpress”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “godaddy”
brand in page title, not in the name “wordpress”
brand in page title, not in the name “google”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “wordpress”
brand in page title, not in the name “google”
brand in page title, not in the name “cloudflare”
Same data as JSON: /api/zone/risk?day=2026-09-14&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.