Flagged newborn domains, Wednesday, September 16, 2026
4,221 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
lure words (login, verify, secure…) “win”TLD with a high abuse rate “lol”brand in page title, not in the name “chase”
many hyphens “3”TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “claim”TLD with a high abuse rate “fun”brand in page title, not in the name “robinhood”
brand in the name “instagram”very long name “30”brand plus digits “impulsioneoinstagramem5minutos”brand name at a retail registrar “Wix.com Ltd.”
one-letter brand typo “laporte≈laposte”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “portal”TLD with a high abuse rate “lol”brand in page title, not in the name “tiktok”
lure words (login, verify, secure…) “portal”TLD with a high abuse rate “lol”brand in page title, not in the name “tiktok”
very long name “29”brand in page title, not in the name “hostinger”identical page on many newborns “214 identical pages”
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “strype≈stripe”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “tlktok≈tiktok”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “turbotag≈turbotax”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “track”TLD with a high abuse rate “xyz”brand in page title, not in the name “steam”
page pushes urgent payment “risk-free”brand in page title, not in the name “wordpress”
punycode name “매쓰플랜명지수학 scripts=HANGUL”very long name “28”random-looking name “H=4.03”form submits over plain HTTP “http://xn--lj2b76b3nm6v6tdj9illvzra.shop”
very long name “29”TLD with a high abuse rate “icu”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “airbnb”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “squarespace”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “namecheap”
page impersonates a brand “USPS”page sells replica goods “Replica Handbag”
page impersonates a brand “USPS”page sells replica goods “replica handbag”
punycode name “仙拍城 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--cnq31tjqj.top/”
punycode name “gwendolinemeuniermagnétisme scripts=LATI”brand in the name “lineme”
ambiguous brand word “apple”many hyphens “3”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “apple”
punycode name “全球旅游網 scripts=CJK”random-looking name “H=3.61”TLD with a high abuse rate “top”
punycode name “全球旅游网 scripts=CJK”random-looking name “H=3.61”TLD with a high abuse rate “top”
punycode name “心理研究 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “bond”
punycode name “心理研究 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “click”
punycode name “心理研究 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “fun”
punycode name “心理研究 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “icu”
punycode name “心理研究 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “原神礦業大學 scripts=CJK”random-looking name “H=3.82”TLD with a high abuse rate “top”
punycode name “上杉绘梨衣 scripts=CJK”random-looking name “H=4.04”TLD with a high abuse rate “top”
punycode name “上杉繪梨衣 scripts=CJK”random-looking name “H=4.14”TLD with a high abuse rate “top”
punycode name “凯旋娱乐 scripts=CJK”random-looking name “H=3.66”TLD with a high abuse rate “lol”
punycode name “非凡娱乐 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “lol”
punycode name “數字藏品 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “数字藏品 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “巅峰国际 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “lol”
punycode name “汇赢国际 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “lol”
punycode name “梦想国际 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “lol”
punycode name “征途国际 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “lol”
punycode name “龙腾国际 scripts=CJK”random-looking name “H=3.91”TLD with a high abuse rate “lol”
punycode name “赏金国际 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “lol”
punycode name “原神矿业大学 scripts=CJK”random-looking name “H=4.11”TLD with a high abuse rate “top”
punycode name “凯旋国际 scripts=CJK”random-looking name “H=3.91”TLD with a high abuse rate “lol”
punycode name “灯塔加速器 scripts=CJK”random-looking name “H=3.93”TLD with a high abuse rate “xyz”
Same data as JSON: /api/zone/risk?day=2026-09-16&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.