Flagged newborn domains, Monday, September 21, 2026

787 names at tier high or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalpaypalreq.spacescore 85echoes paypal· active website
brand in the namepaypalpage impersonates a brandPayPalbrand name and brand-styled pagepaypalform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: PayPal), confidence 97%. An opinion, not a finding.

Criticalbestbuycanadas.comscore 77echoes bestbuy· active website
brand in the namebestbuybrand name at a retail registrarWeb Commerce Communications Limited dba brand name at a watch-list registrarWeb Commerce Communications Limited dba brand name and brand-styled pagebestbuy+1 more

Model opinion: looks like phishing (target: Best Buy), confidence 94%. An opinion, not a finding.

Criticalpaypalcasino.appscore 73echoes paypal· active website
brand in the namepaypalbrand name behind Cloudflarecloudflare.compage impersonates a brandpaypalbrand name and brand-styled pagepaypal

Model opinion: looks like abuse (target: PayPal), confidence 82%. An opinion, not a finding.

Criticalaxl777-mobile.xyzscore 69echoes tmobile· active website
brand spelled with digitsaxl777-mobile→tmobilebrand plus digitsaxl777-mobileTLD with a high abuse ratexyzform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 89%. An opinion, not a finding.

Criticaldora77-mobile.xyzscore 69echoes tmobile· active website
brand spelled with digitsdora77-mobile→tmobilebrand plus digitsdora77-mobileTLD with a high abuse ratexyzform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalsstiktok.appscore 69echoes tiktok· active website
brand in the nametiktokbrand name behind Cloudflarecloudflare.combrand name and brand-styled pagetiktokform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: TikTok), confidence 58%. An opinion, not a finding.

Criticalbestbuyhearing.onlinescore 68echoes bestbuy· active website
brand in the namebestbuybrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalhdtv4k.xyzscore 68· active website
TLD with a high abuse ratexyzpage impersonates a brandnetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 96%. An opinion, not a finding.

Criticalonaircoins.comscore 68· active website
page asks for credentialsVerify your accountbrand in page title, not in the nameinstagramform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalpropassnp.xyzscore 68· active website
TLD with a high abuse ratexyzpage impersonates a brandNETFLIXbrand in page title, not in the namewhatsappform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalwhatsappnumberishere.shopscore 68echoes whatsapp· active website
brand in the namewhatsappbrand in page title, not in the namewordpressform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 52%. An opinion, not a finding.

Criticaltiptok.techscore 66echoes tiktok· active website
one-letter brand typotiptok≈tiktokbrand in page title, not in the nametiktokform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 58%. An opinion, not a finding.

Criticalroblox-high-school-2.wikiscore 65echoes roblox· active website
brand in the namerobloxmany hyphens3brand plus digitsroblox-high-school-2brand name behind Cloudflarecloudflare.com+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalthehuntroblox.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: suspicious (target: Roblox), confidence 60%. An opinion, not a finding.

Criticaletsy-reverse-fee.onlinescore 63echoes etsy· active website
brand in the nameetsybrand name and brand-styled pageetsyform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalsamyagentewhatsapp.onlinescore 63echoes whatsapp· active website
brand in the namewhatsappbrand name and brand-styled pagewhatsappform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaltr3zor.netscore 63echoes trezor· active website
brand spelled with digitstr3zor→trezorbrand plus digitstr3zorbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.+1 more

Model opinion: looks like abuse (target: Trezor), confidence 75%. An opinion, not a finding.

Criticalvanguardstrength.storescore 63echoes vanguard· active website
brand in the namevanguardbrand name and brand-styled pagevanguardform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalwalmartvaluewithdraw.proscore 63echoes walmart· active website
brand in the namewalmartbrand name and brand-styled pagewalmartform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Walmart), confidence 62%. An opinion, not a finding.

Critical916-mobile-detail.netscore 62echoes tmobile· active website
one-letter brand typomobile≈tmobilebrand plus digits916-mobile-detailbrand name at a retail registrarHosting Concepts B.V. d/b/a Registrar.euform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 96%. An opinion, not a finding.

Criticalmytrustwallet.appscore 62echoes trustwallet· active website
brand in the nametrustwalletlure words (login, verify, secure…)walletbrand name on a rarely-seen nameserveroffsh.nl

Model opinion: looks like phishing (target: Trust Wallet), confidence 91%. An opinion, not a finding.

Criticaltubebay.storescore 62echoes ebay· active website
brand in the nameebaybrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Criticalbalitrip.todayscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticaldeskbot.storescore 60· active website
page impersonates a brandCoinbasebrand in page title, not in the namerobinhoodform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Criticalmobile-reviews.sitescore 60echoes tmobile· active website
one-letter brand typomobile≈tmobilebrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticalukestablishment.comscore 60· active website
page impersonates a brandHMRCbrand in page title, not in the namerevolutform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Criticalvelotrade.sitescore 60· active website
page impersonates a brandBinancebrand in page title, not in the namebinanceform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 86%. An opinion, not a finding.

Criticalwingman.tradingscore 60· active website
page impersonates a brandCoinbasebrand in page title, not in the namecoinbaseform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticalyoutubenetworkcms.onlinescore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namefacebookform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: YouTube), confidence 68%. An opinion, not a finding.

Highinstagram-homebet88.onlinescore 59echoes instagram· active website
brand in the nameinstagrambrand plus digitsinstagram-homebet88brand name behind Cloudflarecloudflare.combrand name and brand-styled pageinstagram

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Highlazada-homebet88.onlinescore 59echoes lazada· active website
brand in the namelazadabrand plus digitslazada-homebet88brand name behind Cloudflarecloudflare.combrand name and brand-styled pagelazada

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Highnintendopsenterprise.spacescore 59echoes nintendo· active website
brand in the namenintendobrand name behind Cloudflarecloudflare.combrand name at a retail registrarCloudflare, Inc.brand name and brand-styled pagenintendo

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Highrobloxmam.xyzscore 59echoes roblox· active website
brand in the namerobloxTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name and brand-styled pageroblox

Model opinion: looks like phishing (target: Roblox), confidence 78%. An opinion, not a finding.

Highrobloxscriptsarchive.xyzscore 59echoes roblox· active website
brand in the namerobloxTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name and brand-styled pageroblox

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Hightiktok-homebet88.onlinescore 59echoes tiktok· active website
brand in the nametiktokbrand plus digitstiktok-homebet88brand name behind Cloudflarecloudflare.combrand name and brand-styled pagetiktok

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Highurgent-bankofamerica.sbsscore 59echoes bankofamerica· active website
brand in the namebankofamericaTLD with a high abuse ratesbsbrand name on a rarely-seen nameserverbb-online.bizbrand name and brand-styled pagebankofamerica

Model opinion: suspicious (target: Bank of America), confidence 55%. An opinion, not a finding.

Highvanguardcontainer.comscore 59echoes vanguard· active website
brand in the namevanguardbrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABbrand name and brand-styled pagevanguard

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Highgwszp.cfdscore 58· active website
TLD with a high abuse ratecfdfree DNS providerdnsowl.compage impersonates a brandDHLbrand in page title, not in the namefedex

Model opinion: suspicious, confidence 62%. An opinion, not a finding.

Highshopeenaga15.sitescore 58echoes shopee· active website
brand in the nameshopeebrand plus digitsshopeenaga15brand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.+1 more

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Highthe-hunt-roblox20.wikiscore 57echoes roblox· active website
brand in the namerobloxbrand plus digitsthe-hunt-roblox20brand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.+2 more

Model opinion: suspicious, confidence 52%. An opinion, not a finding.

Highelitechain-finance.xyzscore 56echoes binance· active website
one-letter brand typofinance≈binanceTLD with a high abuse ratexyzbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSav.com, LLC+1 more

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

Highlinkedintern.appscore 56echoes linkedin· active website
brand in the namelinkedinbrand name at a retail registrarGoDaddy.com, LLCform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highparcelpay.funscore 56· active website
lure words (login, verify, secure…)parcelTLD with a high abuse ratefunpage impersonates a brandFedExbrand in page title, not in the namerobinhood

Model opinion: looks like a scam, confidence 65%. An opinion, not a finding.

Highslack-tide.orgscore 56echoes slack· active website
brand in the nameslackbrand name at a retail registrareNom, LLCform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Hightiktok.boatsscore 56echoes tiktok· active website
brand in the nametiktokTLD with a high abuse rateboatsbrand name at a retail registrarGname.com Pte. Ltd.brand name at a watch-list registrarGname.com Pte. Ltd.+2 more

Model opinion: looks like a scam (target: TikTok), confidence 70%. An opinion, not a finding.

Highyoomicloud.onlinescore 56echoes icloud· active website
brand in the nameicloudbrand name at a retail registrarGoDaddy.com, LLCform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

High022721coinbase.comscore 55echoes coinbase
brand in the namecoinbasebrand plus digits022721coinbasebrand name behind Cloudflarecloudflare.combrand name at a retail registrarNICENIC INTERNATIONAL GROUP CO., LIMITED+1 more

Model opinion: suspicious (target: Coinbase), confidence 72%. An opinion, not a finding.

High192578-coinbase.comscore 55echoes coinbase· blocked the probe
brand in the namecoinbasebrand plus digits192578-coinbaserandom-looking nameH=3.81brand name behind Cloudflarecloudflare.com+4 more

Model opinion: looks like phishing (target: Coinbase), confidence 93%. An opinion, not a finding.

High192578coinbase.comscore 55echoes coinbase· empty page
brand in the namecoinbasebrand plus digits192578coinbaserandom-looking nameH=3.81brand name behind Cloudflarecloudflare.com+2 more

Model opinion: looks like abuse (target: Coinbase), confidence 82%. An opinion, not a finding.

High38942google.comscore 55echoes google
brand in the namegooglebrand plus digits38942googlebrand name behind Cloudflarecloudflare.combrand name at a retail registrarNICENIC INTERNATIONAL GROUP CO., LIMITED+1 more

Model opinion: suspicious (target: Google), confidence 72%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-21&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.