Flagged newborn domains, Wednesday, September 16, 2026
15,119 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
many hyphens “3”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
TLD with a high abuse rate “xyz”login form “has_form+login words”
punycode name “동포마을갯벌체험 scripts=HANGUL”very long name “29”
punycode name “ตั้มรับซื้อของเก่าทุกชนิดราคาสูง scripts”very long name “54”
punycode name “ดอนบริการขนย้ายเครื่องจักร scripts=THAI”very long name “42”
punycode name “โรงงานหลังคาเหล็กทีอาร์ตราหมีกาฬสินธุ์ s”very long name “58”
punycode name “우리동네하수구뚜러 scripts=HANGUL”very long name “33”
punycode name “대구달서자이제니크 scripts=HANGUL”very long name “31”
punycode name “대구전자담배이벤트 scripts=HANGUL”very long name “34”
punycode name “트리플로우에스테틱 scripts=HANGUL”very long name “31”
punycode name “대한민국장인몰 scripts=HANGUL”very long name “28”
punycode name “푸르지오리버프론트 scripts=HANGUL”very long name “30”
punycode name “合同会社橋本自動車 scripts=CJK”very long name “33”
punycode name “詐欺被害相談窓口 scripts=CJK”very long name “28”
punycode name “หนังเอวีซับไทย scripts=THAI”very long name “28”
punycode name “강동세브란스내과 scripts=HANGUL”very long name “28”
punycode name “대한시니어케어매니저협회 scripts=HANGUL”very long name “37”
punycode name “başakşehirarçelikyetkiliservisi scripts=”very long name “31”
punycode name “basketboldadogrubilinenyanlışlar scripts”very long name “31”
punycode name “über-alle-berge scripts=LATIN”ambiguous brand word “uber”
punycode name “อู่ซ่อมรถยนต์ไฟฟ้า scripts=THAI”very long name “32”
punycode name “değirmenalabalıkveköytavuğucom scripts=L”very long name “29”
punycode name “estasseñalesseguiranalosquecreen scripts”very long name “32”
punycode name “etkindisagızvedissaglıgıpoliklinigi scri”very long name “32”
punycode name “中国艺术品交易网 scripts=CJK”very long name “29”
punycode name “industriestrompreisförderung scripts=LAT”very long name “28”
punycode name “창원한신더휴메가센텀 scripts=HANGUL”very long name “35”
punycode name “보람라이프큐레이터 scripts=HANGUL”very long name “31”
punycode name “차차커피코부산연제점 scripts=HANGUL”very long name “35”
punycode name “제일금거래소고양점 scripts=HANGUL”very long name “30”
page impersonates a brand “Netflix”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “Netflix”
page impersonates a brand “Netflix”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “Coinbase”
lure words (login, verify, secure…) “service,services”very long name “33”random-looking name “H=3.63”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “whatsapp”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “namecheap”
brand in page title, not in the name “roblox”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
Same data as JSON: /api/zone/risk?day=2026-09-16&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.