Flagged newborn domains, Friday, September 18, 2026

28 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalwhatsappdep.shopscore 83echoes whatsapp· active website
brand in the namewhatsappbrand name behind Cloudflarecloudflare.combrand name at a retail registrarGNAME.COM PTE. LTD.brand name at a watch-list registrarGNAME.COM PTE. LTD.+2 more

Model opinion: looks like abuse (target: WhatsApp), confidence 78%. An opinion, not a finding.

Criticaltrustwallet-dapps.comscore 78echoes trustwallet· active website
brand in the nametrustwalletlure words (login, verify, secure…)walletpage impersonates a brandBinance

Model opinion: looks like phishing (target: Trust Wallet), confidence 92%. An opinion, not a finding.

Criticalmobile-accessories.storescore 74echoes tmobile· active website
one-letter brand typomobile≈tmobilelure words (login, verify, secure…)accessbrand in page title, not in the namenationwide

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalbigaccounts.orgscore 72· active website
lure words (login, verify, secure…)account,accountspage impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Criticalairvanguard.xyzscore 70echoes vanguard· active website
brand in the namevanguardTLD with a high abuse ratexyzbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UAB+1 more

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalfxfidelity.comscore 69echoes fidelity· active website
brand in the namefidelitybrand name on a rarely-seen nameserverorangehost.combrand name and brand-styled pagefidelityform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 82%. An opinion, not a finding.

Criticalshopnetflixmerch.shopscore 69echoes netflix· active website
brand in the namenetflixpage impersonates a brandNetflixbrand name and brand-styled pagenetflixform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Netflix), confidence 72%. An opinion, not a finding.

Criticalprismo.bondscore 68· active website
TLD with a high abuse ratebondpage impersonates a brandMetaMaskbrand in page title, not in the namelinkedinform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 56%. An opinion, not a finding.

Criticalrevolution-casino.clubscore 68echoes revolut· active website
brand in the namerevolutbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNICENIC INTERNATIONAL GROUP CO., LIMITEDbrand name at a watch-list registrarNICENIC INTERNATIONAL GROUP CO., LIMITED+1 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalstarobserver.topscore 68· active website
TLD with a high abuse ratetoppage impersonates a brandBinancebrand in page title, not in the namebinanceform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalwww-global-smm.comscore 68· active website
page asks for credentialsLog in to your accountbrand in page title, not in the nametelegramform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalbinance-hk.shopscore 67echoes binance· active website
brand in the namebinancepage impersonates a brandBinancebrand name and brand-styled pagebinance

Model opinion: looks like phishing (target: Binance), confidence 97%. An opinion, not a finding.

Criticalslotify.shopscore 66echoes spotify· active website
one-letter brand typoslotify≈spotifybrand in page title, not in the namegoogleform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalsearchfortheneedle-roblox.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalinstagramaudience.infoscore 64echoes instagram· active website
brand in the nameinstagrambrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Incbrand in page title, not in the namewordpress

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalinstagramengagement.wikiscore 64echoes instagram· active website
brand in the nameinstagrambrand name at a retail registrarDynadot Incbrand name at a watch-list registrarDynadot Incbrand in page title, not in the namewordpress

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalinstagraminsights.blogscore 64echoes instagram· active website
brand in the nameinstagrambrand name at a retail registrarDynadot LLCbrand name at a watch-list registrarDynadot LLCbrand in page title, not in the namewordpress

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalvanguardgear.onlinescore 63echoes vanguard· active website
brand in the namevanguardbrand name and brand-styled pagevanguardform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticaltelanganaruchulu.onlinescore 62echoes hulu· active website
brand in the namehulubrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 96%. An opinion, not a finding.

Criticalbuiltproperly.onlinescore 60· active website
page impersonates a brandOffice 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticalnearshore.cloudscore 60· active website
page impersonates a brandMicrosoft 365brand in page title, not in the namemicrosoftform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalpriedge.livescore 60· active website
page impersonates a brandMetaMaskbrand in page title, not in the namerobinhoodform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalsergelutensparfum.shopscore 60· active website
page impersonates a brandPaypalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Serge Lutens), confidence 79%. An opinion, not a finding.

Criticalserial4u.blogscore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 92%. An opinion, not a finding.

Criticalshopkontrolfreek.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namexboxform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: KontrolFreek), confidence 82%. An opinion, not a finding.

Criticalteamtrustwalletsupport.livescore 60echoes trustwallet· active website
brand in the nametrustwalletlure words (login, verify, secure…)support,walletbrand name at a retail registrarNameSilo, LLCbrand name at a watch-list registrarNameSilo, LLC

Model opinion: looks like abuse (target: Trust Wallet), confidence 82%. An opinion, not a finding.

Criticalviral-spark.shopscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalwepayless.storescore 60· active website
page impersonates a brandNetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-18&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.