brand in the name “amazon”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “675 identical pages”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “amazon”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “3306 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
lure words (login, verify, secure…) “access”very long name “31”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 54%. An opinion, not a finding.
one-letter brand typo “betflix≈netflix”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
brand in the name “xbox”brand plus digits “boxbox15”brand name at a retail registrar “Tucows Domains Inc.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “zelle”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “3306 identical pages”
Model opinion: looks benign, confidence 86%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name on a rarely-seen nameserver “ppppkkokolo.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
one-letter brand typo “cloud≈icloud”brand name on a rarely-seen nameserver “vipdigitalservices.pro”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “fedex”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “675 identical pages”
Model opinion: looks like abuse (target: FedEx), confidence 60%. An opinion, not a finding.
brand in the name “zelle”lure words (login, verify, secure…) “billing”brand name at a retail registrar “GoDaddy.com, LLC”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “xbox”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “675 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “google”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “675 identical pages”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
one-letter brand typo “icioud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “lcloud≈icloud”brand name on a rarely-seen nameserver “supermag-5.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “costco”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 48%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “etsy”lure words (login, verify, secure…) “security”brand name at a retail registrar “Network Solutions, LLC”
many hyphens “3”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”
Model opinion: suspicious (target: Netflix), confidence 65%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “sharpoint≈sharepoint”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NAMECHEAP”brand name at a watch-list registrar “NAMECHEAP”
brand in the name “smbc”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “3306 identical pages”
Model opinion: looks like abuse (target: SMBC (Sumitomo Mitsui Card Company)), confidence 70%. An opinion, not a finding.
brand in the name “smbc”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “3306 identical pages”
Model opinion: looks like abuse (target: Sumitomo Mitsui Banking Corporation (SMBC)), confidence 57%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
one-letter brand typo “wochat≈wechat”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
one-letter brand typo “finance≈binance”many hyphens “4”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
punycode name “初心 scripts=CJK”TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
TLD with a high abuse rate “cam”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “stripe”brand plus digits “360stripe”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “binance”brand plus digits “538692-binance”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
TLD with a high abuse rate “cfd”brand in page title, not in the name “airbnb”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: Airbnb), confidence 96%. An opinion, not a finding.
brand in the name “binance”brand plus digits “874827-binance”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “binance”brand plus digits “874828-binance”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
TLD with a high abuse rate “top”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 52%. An opinion, not a finding.
TLD with a high abuse rate “icu”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
TLD with a high abuse rate “cyou”brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
TLD with a high abuse rate “cfd”brand in page title, not in the name “openai”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.
TLD with a high abuse rate “fun”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”
Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
TLD with a high abuse rate “cam”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “gmail”brand plus digits “bloominglavender316gmail”brand name at a retail registrar “DomainRegistry.com LLC”
TLD with a high abuse rate “fun”brand in page title, not in the name “steam”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “chatgpt”brand plus digits “chatgpt-2026”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “chatgpt”brand plus digits “chatgpt-2027”brand name at a retail registrar “GoDaddy.com, LLC”