Flagged newborn domains, Wednesday, September 16, 2026
4,221 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”
brand in the name “telegram”many hyphens “3”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”brand name and brand-styled page “telegram”
brand in the name “revolut”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”brand name and brand-styled page “revolut”
brand in the name “telegram”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”brand name and brand-styled page “telegram”
brand in the name “usaa”brand name at a retail registrar “Neubox Internet S.A. de C.V.”brand in page title, not in the name “wordpress”
brand spelled with digits “kyat7com→attcom”brand plus digits “kyat7com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “chatgpt”brand name at a retail registrar “Name.com, Inc.”form on a brand-styled page “has_form”
brand in the name “icloud”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
punycode name “erwähnt scripts=LATIN”brand in page title, not in the name “google”form on a brand-styled page “has_form”
brand spelled with digits “188va→bbva”brand plus digits “188va”brand name at a retail registrar “Chengdu West Dimension Digital Technolog”identical page on many newborns “735 identical pages”
brand in the name “coinbase”brand plus digits “192834coinbase”random-looking name “H=3.81”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “roblox”brand plus digits “1roblox”TLD with a high abuse rate “xyz”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”+1 more
brand spelled with digits “1xbet-mobil3→tmobile”brand plus digits “1xbet-mobil3”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “private-dns.cc”+2 more
one-letter brand typo “mobile≈tmobile”brand plus digits “1xbet172-mobile”TLD with a high abuse rate “top”brand name at a retail registrar “NameSilo,LLC”+2 more
brand in the name “coinbase”brand plus digits “207439coinbase”random-looking name “H=3.81”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “coinbase”brand plus digits “874362coinbase”random-looking name “H=3.81”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “robinhood”brand plus digits “875434-robinhood”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “cashapp”lure words (login, verify, secure…) “access”TLD with a high abuse rate “xyz”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “adobe”lure words (login, verify, secure…) “confirm”very long name “34”brand name behind Cloudflare “cloudflare.com”+2 more
one-letter brand typo “bookings≈booking”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1357 identical pages”
brand in the name “amazon”brand plus digits “amazon688”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “ledger”brand plus digits “auth03-ledger”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Same data as JSON: /api/zone/risk?day=2026-09-16&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.