Flagged newborn domains, Saturday, September 19, 2026
10,568 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
brand in the name “icloud”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”brand name redirects elsewhere “72.chat”
Model opinion: looks like abuse, confidence 62%. An opinion, not a finding.
brand in the name “icloud”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Model opinion: suspicious (target: Apple), confidence 72%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “japan-tiktok-6”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “ebay”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 65%. An opinion, not a finding.
TLD with a high abuse rate “click”page asks for credentials “Sign in to your account”login form “has_form+login words”
Model opinion: suspicious, confidence 62%. An opinion, not a finding.
lure words (login, verify, secure…) “login”TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “mizuho”brand plus digits “mizu-hokkaido24”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Metaregistrar BV”
brand in the name “office365”brand plus digits “office3655documentsszzzz”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
brand in the name “paypal”lure words (login, verify, secure…) “pay”many hyphens “4”brand name behind Cloudflare “cloudflare.com”
brand in the name “paypal”lure words (login, verify, secure…) “pay”many hyphens “3”brand name behind Cloudflare “cloudflare.com”
brand in the name “icloud”TLD with a high abuse rate “cyou”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “roblox”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”
brand in the name “slack”TLD with a high abuse rate “click”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “taobao”brand plus digits “taobao-indb2b”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
page asks for credentials “Verify Your Identity”page impersonates a brand “Office 365”
Model opinion: looks like phishing (target: Greenvelope (with Google/Microsoft webmail credential harvest)), confidence 97%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “tik-tok-18”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”
brand in the name “tiktok”brand plus digits “tiktok-777”brand name on a rarely-seen nameserver “awsdns-18.net”brand name at a retail registrar “Amazon Registrar, Inc.”
ambiguous brand word “ledger”lure words (login, verify, secure…) “update”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “tmobile”brand plus digits “v21tmobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “wechat”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
brand in the name “usps”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Aceville Pte. Ltd.”
brand spelled with digits “linkit4u→itau”brand plus digits “linkit4u”brand name at a retail registrar “123-Reg Limited”
brand in the name “telegram”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “telegram”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand spelled with digits “wehandleit4u→itau”brand plus digits “wehandleit4u”brand name at a retail registrar “GoDaddy.com, LLC”
TLD with a high abuse rate “lol”page impersonates a brand “Netflix”brand in page title, not in the name “chatgpt”
Model opinion: suspicious, confidence 72%. An opinion, not a finding.
brand in the name “etsy”brand plus digits “1xbet-syd12”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”+2 more
one-letter brand typo “allpay≈alipay”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name redirects elsewhere “allpay.to”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “amazon”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “amazon”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti21”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti22”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti23”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti24”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti25”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti26”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti27”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti28”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti29”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti30”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti31”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti32”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti33”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti34”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti35”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti36”brand name at a retail registrar “Dominet (HK) Limited”
Model opinion: looks like phishing (target: American Express), confidence 85%. An opinion, not a finding.
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti37”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti38”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti39”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti40”brand name at a retail registrar “Dominet (HK) Limited”
Model opinion: looks like phishing (target: American Express), confidence 72%. An opinion, not a finding.
brand in the name “americanexpress”very long name “33”brand plus digits “americanexpressconversionepunti41”brand name at a retail registrar “Dominet (HK) Limited”
Model opinion: looks like phishing (target: American Express), confidence 80%. An opinion, not a finding.
Same data as JSON: /api/zone/risk?day=2026-09-19&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.