brand in the name “binance”TLD with a high abuse rate “fun”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
brand in the name “cibc”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “zelle”TLD with a high abuse rate “click”brand name at a retail registrar “Dynadot, LLC”brand name at a watch-list registrar “Dynadot, LLC”
brand in the name “tmobile”brand plus digits “cu888tmobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “disney”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Model opinion: suspicious (target: Disney), confidence 65%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “2654 identical pages”
Model opinion: looks benign, confidence 92%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “gmail613”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “google”brand plus digits “google-1s”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “google”brand plus digits “google82”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
brand in the name “ionos”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name redirects elsewhere “marketwatch.com”
brand in the name “hulu”TLD with a high abuse rate “work”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
brand in the name “gmail”brand plus digits “knightrider0479gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Highlinkedit.bizscore 52echoes linkedin· registrar placeholder one-letter brand typo “linkedit≈linkedin”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4673 identical pages”
Model opinion: looks benign, confidence 92%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “openai”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “opensea”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
brand in the name “xbox”TLD with a high abuse rate “click”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
brand in the name “whatsapp”TLD with a high abuse rate “icu”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
brand in the name “sharepoint”brand plus digits “sa1-sharepoint”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Instra Corporation Pty Ltd.”
brand in the name “schwab”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “smbc”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
brand in the name “twitter”TLD with a high abuse rate “download”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “google”brand plus digits “test-82348234-google”brand name on a rarely-seen nameserver “mailforgus.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “tiktok”brand plus digits “tiktok18x”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
brand in the name “tiktok”brand plus digits “tiktok4men”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
brand in the name “tiktok”TLD with a high abuse rate “fun”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “tiktok”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
page pushes urgent payment “risk-free”brand in page title, not in the name “chase”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 66%. An opinion, not a finding.
Hightrevor.ripscore 52echoes trezor· boilerplate page one-letter brand typo “trevor≈trezor”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “2654 identical pages”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “trezor”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
page asks for credentials “Sign in to your account”page impersonates a brand “IRS”
Model opinion: looks like phishing (target: IRS), confidence 96%. An opinion, not a finding.
brand in the name “google”brand plus digits “v2google”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
page asks for credentials “Verify Your Identity”page impersonates a brand “Binance”
Model opinion: looks like phishing (target: Binance), confidence 94%. An opinion, not a finding.
brand in the name “icloud”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Model opinion: suspicious (target: Apple (iCloud)), confidence 72%. An opinion, not a finding.
brand in the name “tmobile”brand plus digits “yy123tmobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “adobe”TLD with a high abuse rate “icu”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand spelled with digits “47mobile→tmobile”brand plus digits “47mobile”brand name at a retail registrar “GoDaddy.com, LLC”
brand spelled with digits “aviator-sites-14→tesla”brand plus digits “aviator-sites-14”TLD with a high abuse rate “top”
brand in the name “etsy”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “etsy”
Model opinion: suspicious (target: Etsy), confidence 60%. An opinion, not a finding.
brand spelled with digits “b00king1→booking”brand plus digits “b00king1”free DNS provider “dnsowl.com”
Highch4s3r.orgscore 51echoes chase· robots.txt denied brand spelled with digits “ch4s3r→chase”brand plus digits “ch4s3r”brand name at a retail registrar “Squarespace Domains LLC”
brand in the name “stripe”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “stripe”
Model opinion: suspicious (target: Stripe), confidence 72%. An opinion, not a finding.
brand in the name “google”brand name on a rarely-seen nameserver “kriweb.com”brand name and brand-styled page “google”
Model opinion: looks like phishing (target: Google), confidence 62%. An opinion, not a finding.
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “whatsapp”
Model opinion: looks like abuse (target: WhatsApp), confidence 72%. An opinion, not a finding.
brand spelled with digits “kwikfit4u→itau”brand plus digits “kwikfit4u”brand name at a retail registrar “Tucows Domains Inc.”
brand spelled with digits “micros0ftsolutions→microsoft”brand plus digits “micros0ftsolutions”free DNS provider “dnsowl.com”
Model opinion: looks like abuse (target: Microsoft), confidence 72%. An opinion, not a finding.
brand in the name “smbc”very long name “32”random-looking name “H=4.12”TLD with a high abuse rate “rest”+3 more
ambiguous brand word “phantom”TLD with a high abuse rate “work”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “phantom”+1 more
Model opinion: suspicious, confidence 58%. An opinion, not a finding.
brand in the name “robinhood”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “robinhood”
Model opinion: looks like phishing (target: Robinhood), confidence 96%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand plus digits “4d-finance-tbf”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”