Flagged newborn domains, Friday, September 18, 2026

2,258 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Critical+High+Medium+Low+day:09-18 09-17 09-16 09-15 09-14 09-13 09-12 09-11 09-10 09-09

Highslivstiktok.cfdscore 52echoes tiktok· active website

brand in the name “tiktok”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Highstarlink4dgas.topscore 52echoes starlink· not probed yet

brand in the name “starlink”brand plus digits “starlink4dgas”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”

Highstrike.questscore 52echoes stripe· parked, for sale

one-letter brand typo “strike≈stripe”TLD with a high abuse rate “quest”brand name at a retail registrar “Atom.com Domains LLC”brand name redirects elsewhere “atom.com”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Hightiktik.livescore 52echoes tiktok· registrar placeholder

one-letter brand typo “tiktik≈tiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4366 identical pages”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Hightwittar.sitescore 52echoes twitter· registrar placeholder

one-letter brand typo “twittar≈twitter”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4366 identical pages”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highusaaa.bondscore 52echoes usaa· no DNS

brand in the name “usaa”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NicNames, Inc.”

Highvanguardbeardumpsters.cyouscore 52echoes vanguard· active website

brand in the name “vanguard”TLD with a high abuse rate “cyou”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Highweb-telegram.cyouscore 52echoes telegram· empty page

brand in the name “telegram”TLD with a high abuse rate “cyou”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”

Model opinion: looks like phishing (target: Telegram), confidence 96%. An opinion, not a finding.

Highworkt.winscore 52· active website

TLD with a high abuse rate “win”page asks for credentials “Sign in to your account”login form “has_form+login words”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Highzofiamarshallpianoandviolintuition.blogscore 52echoes intuit· redirects elsewhere

brand in the name “intuit”very long name “34”brand name at a retail registrar “Automattic Inc.”form on a brand-styled page “has_form”+1 more

Highbankofamerica-form.orgscore 51echoes bankofamerica· active website

brand in the name “bankofamerica”brand name on a rarely-seen nameserver “bb-online.biz”brand name and brand-styled page “bankofamerica”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highcasino-telegram.orgscore 51echoes telegram· active website

brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “telegram”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Highheng888v4.comscore 51echoes bbva

brand spelled with digits “heng888v4→bbva”brand plus digits “heng888v4”brand name at a retail registrar “GoDaddy.com, LLC”

Highinvestappl3.comscore 51echoes apple

brand spelled with digits “investappl3→apple”brand plus digits “investappl3”brand name at a retail registrar “OpusDNS GmbH”

Highmm88v4.vipscore 51echoes bbva· redirects elsewhere

brand spelled with digits “mm88v4→bbva”brand plus digits “mm88v4”brand name redirects elsewhere “mm88q.com”

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Highphantom-heat.onlinescore 51echoes phantom· active website

ambiguous brand word “phantom”brand name at a retail registrar “IONOS SE”brand name and brand-styled page “phantom”form on a brand-styled page “has_form”+1 more

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Hight928273-coinbase.comscore 51echoes coinbase

brand in the name “coinbase”brand plus digits “t928273-coinbase”random-looking name “H=3.77”free DNS provider “dnsowl.com”

Highthehuntroblox20.wikiscore 51echoes roblox· active website

brand in the name “roblox”brand plus digits “thehuntroblox20”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Highwhatsappeqb.shopscore 51echoes whatsapp· boilerplate page