Flagged newborn domains, Wednesday, September 16, 2026

1,975 names at tier high or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalmailicloud.topscore 91echoes icloud· active website
brand in the nameicloudTLD with a high abuse ratetopbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNamecheap Inc.+3 more

Model opinion: looks like abuse, confidence 84%. An opinion, not a finding.

Criticalshopifyradar.devscore 83echoes shopify· active website
brand in the nameshopifybrand name behind Cloudflarecloudflare.compage pushes urgent paymentrisk-freebrand name and brand-styled pageshopify+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticaltelegramifsaarsivi.lolscore 73echoes telegram· active website
brand in the nametelegramTLD with a high abuse ratelolbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Inc+2 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalnepchat.appscore 72· active website
page asks for credentialsVerify your identitypage impersonates a brandPayPalbrand in page title, not in the namepaypal

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalbolivia-1-1-tikktok.sbsscore 70echoes tiktok· active website
one-letter brand typotikktok≈tiktokmany hyphens3brand plus digitsbolivia-1-1-tikktokTLD with a high abuse ratesbs+1 more

Model opinion: looks like abuse (target: TikTok), confidence 92%. An opinion, not a finding.

Criticalintuitive.softwarescore 70echoes intuit· active website
brand in the nameintuitbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticaltrustwallets.storescore 70echoes trustwallet· active website
brand in the nametrustwalletlure words (login, verify, secure…)walletbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB

Model opinion: looks like phishing (target: Trust Wallet), confidence 90%. An opinion, not a finding.

Criticalorangeoutlook.orgscore 69echoes outlook· active website
brand in the nameoutlookbrand name behind Cloudflarecloudflare.combrand name and brand-styled pageoutlookform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 97%. An opinion, not a finding.

Criticalvayicloud.appscore 69echoes icloud· active website
brand in the nameicloudbrand name behind Cloudflarecloudflare.combrand name and brand-styled pageicloudform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalfreemovies.buzzscore 68· active website
TLD with a high abuse ratebuzzpage impersonates a brandNetFlixbrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 95%. An opinion, not a finding.

Criticalb2blinkedin.marketingscore 67echoes linkedin· active website
brand in the namelinkedinbrand plus digitsb2blinkedinbrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticalmediafused.storescore 66· active website
page asks for credentialslog in to your accountpage impersonates a brandPayPallogin formhas_form+login words

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalwestpaw.livescore 66echoes westpac· active website
one-letter brand typowestpaw≈westpacbrand name behind Cloudflarecloudflare.combrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Inc+1 more

Model opinion: suspicious (target: West Paw), confidence 56%. An opinion, not a finding.

Criticalmetamaskwallet.icuscore 64echoes metamask· active website
brand in the namemetamasklure words (login, verify, secure…)walletTLD with a high abuse rateicu

Model opinion: looks like abuse (target: MetaMask), confidence 82%. An opinion, not a finding.

Criticalrobinhoodape.funscore 64echoes robinhood· active website
brand in the namerobinhoodTLD with a high abuse ratefunbrand name at a retail registrarName.com, Inc.form on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaltrijicloud.onlinescore 64echoes icloud· active website
brand in the nameicloudbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABbrand in page title, not in the namewhatsapp

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticalusdt-finance.orgscore 64echoes binance· active website
one-letter brand typofinance≈binancebrand name behind Cloudflarecloudflare.combrand name at a retail registrarGoDaddy.com, LLCpage impersonates a brandMetaMask

Model opinion: looks like a scam, confidence 92%. An opinion, not a finding.

Criticalgiristelegram.comscore 63echoes telegram· active website
brand in the nametelegrambrand name and brand-styled pagetelegramform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Criticalkupit-zvezdy-telegram-avtomaticheski.onlinescore 63echoes telegram· active website
brand in the nametelegrammany hyphens3very long name36brand name at a retail registrarRegistrar of Domain Names REG.RU LLC+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalkupit-zvezdy-telegram-bez-pereplat.onlinescore 63echoes telegram· active website
brand in the nametelegrammany hyphens4very long name34brand name at a retail registrarRegistrar of Domain Names REG.RU LLC+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalkupit-zvezdy-telegram-deshevo.onlinescore 63echoes telegram· active website
brand in the nametelegrammany hyphens3very long name29brand name at a retail registrarRegistrar of Domain Names REG.RU LLC+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalkupit-zvezdy-telegram-kruglosutochno.onlinescore 63echoes telegram· active website
brand in the nametelegrammany hyphens3very long name36brand name at a retail registrarRegistrar of Domain Names REG.RU LLC+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalamazoninvites.topscore 62echoes amazon· active website
brand in the nameamazonTLD with a high abuse ratetopbrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: looks like a scam (target: Amazon), confidence 72%. An opinion, not a finding.

Criticalcloud-mail.appscore 62echoes icloud· active website
one-letter brand typocloud≈icloudbrand name at a retail registrarNamecheap Inc.brand name at a watch-list registrarNamecheap Inc.brand in page title, not in the namenamecheap

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalsantanderplaygorund.orgscore 62echoes santander· active website
brand in the namesantanderbrand name at a retail registrarArsys Internet, S.L. dba NICLINE.COMform on a brand-styled pagehas_formform submits over plain HTTPhttp://santanderplaygorund.org/

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Criticalvenmoprovip.topscore 62echoes venmo· active website
brand in the namevenmoTLD with a high abuse ratetopbrand name behind Cloudflarecloudflare.comform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Venmo), confidence 97%. An opinion, not a finding.

Criticalxfini-app-comscast.fitscore 62echoes comcast· active website
one-letter brand typocomscast≈comcastbrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.brand in page title, not in the namenamecheap

Model opinion: looks like abuse (target: Comcast Xfinity), confidence 86%. An opinion, not a finding.

Criticalaamhldjn.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

Criticalaaodwtvi.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

Criticalabdotsee.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 58%. An opinion, not a finding.

Criticalabudoxdx.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

Criticaladhrofew.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalaecgltgt.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalaeiewufu.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

Criticalagjczrod.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalahqsiycd.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticalainmekoi.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 66%. An opinion, not a finding.

Criticalaipqyrpr.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 78%. An opinion, not a finding.

Criticalajtrzbrg.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalajyslowo.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticalalmfosxh.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

Criticalalrrirps.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalamemnirl.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 78%. An opinion, not a finding.

Criticalamigoppj.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalanlgyjpu.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 75%. An opinion, not a finding.

Criticalaoyakpfy.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 72%. An opinion, not a finding.

Criticalapskgjyz.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticalarchpay.spacescore 60· active website
page impersonates a brandMetaMaskbrand in page title, not in the namemetamaskform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 67%. An opinion, not a finding.

Criticalarmitotf.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 65%. An opinion, not a finding.

Criticalarrdssuy.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 68%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-16&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.