brand in the name “bybit”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “mobile≈tmobile”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “cibc”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “rest”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+2 more
Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.
one-letter brand typo “coacast≈comcast”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “coinbase”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “ebay”lure words (login, verify, secure…) “bonus”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “ozelns.com”
brand in the name “icloud”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “591 identical pages”+1 more
Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.
brand spelled with digits “finance94-accusamus44→usaa”brand plus digits “finance94-accusamus44”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”
brand spelled with digits “fit-4-u→itau”brand plus digits “fit-4-u”brand in page title, not in the name “cloudflare”
Model opinion: unreachable when judged, confidence 86%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “freem0dstiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Gname.com Pte. Ltd.”+1 more
Model opinion: looks like abuse (target: TikTok), confidence 65%. An opinion, not a finding.
brand spelled with digits “gasing777mobile→tmobile”brand plus digits “gasing777mobile”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “132 identical pages”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand spelled with digits “gasing777mobile→tmobile”brand plus digits “gasing777mobile”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”+3 more
Model opinion: suspicious, confidence 62%. An opinion, not a finding.
brand spelled with digits “gasing777mobile→tmobile”brand plus digits “gasing777mobile”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “gmail1919”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “gmail”free DNS provider “dnsowl.com”form on a brand-styled page “has_form”
brand in the name “google”lure words (login, verify, secure…) “support”
brand in the name “google”lure words (login, verify, secure…) “verification”very long name “58”brand plus digits “google-site-verification5unrw1ikjqtq3jce”
brand in the name “google”lure words (login, verify, secure…) “track”brand name behind Cloudflare “cloudflare.com”
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “guestverify33221-booking”
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “guestverify33288-booking”
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “guestverify74112-booking”
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “guestverify7722-booking”
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “guestverify79110-booking”brand name at a retail registrar “Web Commerce Communications Limited dba ”+1 more
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “guestverify8333-booking”
brand in the name “booking”lure words (login, verify, secure…) “verify”brand plus digits “guestverify8822-booking”
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
Model opinion: suspicious (target: Apple), confidence 62%. An opinion, not a finding.
brand in the name “uniswap”TLD with a high abuse rate “mom”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
brand in the name “shopify”lure words (login, verify, secure…) “access,account”very long name “51”brand plus digits “httpsadminshopifycomstoremindrest-9089ac”+1 more
Model opinion: looks like phishing (target: Shopify), confidence 72%. An opinion, not a finding.
brand in the name “shopify”lure words (login, verify, secure…) “access,account”very long name “51”brand plus digits “httpsadminshopifycomstoremindrest-9089ac”
brand in the name “shopify”lure words (login, verify, secure…) “access,account”very long name “51”brand plus digits “httpsadminshopifycomstoremindrest-9089ac”+1 more
Model opinion: looks like phishing (target: Shopify), confidence 75%. An opinion, not a finding.
brand in the name “stripe”TLD with a high abuse rate “mom”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
brand in the name “icloud”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+1 more
brand in the name “icloud”brand name on a rarely-seen nameserver “soportedns.top”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”+1 more
Model opinion: looks like abuse (target: Apple (iCloud)), confidence 70%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”TLD with a high abuse rate “cam”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “ledger”lure words (login, verify, secure…) “secure”
brand in the name “apple”lure words (login, verify, secure…) “id,login”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “mcloud≈icloud”brand name on a rarely-seen nameserver “park-my-domain.net”brand name at a retail registrar “Virtualia LLC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “medicare”lure words (login, verify, secure…) “verification”
Model opinion: suspicious, confidence 63%. An opinion, not a finding.
brand in the name “microsoft”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”+1 more
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “pay”many hyphens “3”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.
one-letter brand typo “offece365≈office365”brand plus digits “offece365”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “HOSTINGER operations, UAB”+1 more
one-letter brand typo “linkedln≈linkedin”lure words (login, verify, secure…) “pay”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
lure words (login, verify, secure…) “payment,payments,service”TLD with a high abuse rate “top”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 62%. An opinion, not a finding.
brand in the name “paypal”lure words (login, verify, secure…) “support”identical page on many newborns “44 identical pages”
Model opinion: looks like abuse (target: PayPal), confidence 82%. An opinion, not a finding.
brand in the name “stripe”lure words (login, verify, secure…) “portal”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”+1 more
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “quickbooks”lure words (login, verify, secure…) “support”brand name on a rarely-seen nameserver “rayname.com”
brand in the name “tmobile”lure words (login, verify, secure…) “service”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”
brand in the name “okta”lure words (login, verify, secure…) “recover”brand name behind Cloudflare “cloudflare.com”