Flagged newborn domains, Monday, September 21, 2026

15,107 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Lowethsupporting.xyzscore 14· not probed yet
lure words (login, verify, secure…) “support”TLD with a high abuse rate “xyz”
Lowetlaccessagent.xyzscore 14· not probed yet
lure words (login, verify, secure…) “access”TLD with a high abuse rate “xyz”
Lowetlaccesslabs.xyzscore 14· not probed yet
lure words (login, verify, secure…) “access”TLD with a high abuse rate “xyz”
Lowetldatatracker.xyzscore 14· not probed yet
lure words (login, verify, secure…) “track”TLD with a high abuse rate “xyz”
Lowetlsecurityai.xyzscore 14· not probed yet
lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
Lowetlsecurityapp.xyzscore 14· not probed yet
lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
Lowetlsecurityhub.xyzscore 14· not probed yet
lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
Lowetlsecuritykit.xyzscore 14· not probed yet
lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
Lowetlsecuritylab.xyzscore 14· not probed yet
lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
Loweuclideum.cloudscore 14· active website
login form “has_form+login words”
Lowevatrust.onlinescore 14· active website
login form “has_form+login words”
Loweveningpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Loweventaccessai.xyzscore 14· not probed yet
lure words (login, verify, secure…) “access”TLD with a high abuse rate “xyz”
Loweventsaccessai.xyzscore 14· not probed yet
lure words (login, verify, secure…) “access”TLD with a high abuse rate “xyz”
Loweventspayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowevidentpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowevidentwallet.xyzscore 14· not probed yet
lure words (login, verify, secure…) “wallet”TLD with a high abuse rate “xyz”
Lowevmclaimdrops.xyzscore 14· not probed yet
lure words (login, verify, secure…) “claim”TLD with a high abuse rate “xyz”
Lowevmwalletsign.xyzscore 14· not probed yet
lure words (login, verify, secure…) “wallet”TLD with a high abuse rate “xyz”
Lowexacthelpdesk.xyzscore 14· not probed yet
lure words (login, verify, secure…) “helpdesk”TLD with a high abuse rate “xyz”
Lowexactinvoices.xyzscore 14· not probed yet
lure words (login, verify, secure…) “invoice”TLD with a high abuse rate “xyz”
Lowexamplepayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexbybitaxea-tw.comscore 14echoes bybit· no DNS
brand in the name “bybit”
Lowexceptpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexchangeaccess.xyzscore 14· not probed yet
lure words (login, verify, secure…) “access”TLD with a high abuse rate “xyz”
Lowexchangeunlock.xyzscore 14· not probed yet
lure words (login, verify, secure…) “unlock”TLD with a high abuse rate “xyz”
Lowexchangeupdate.xyzscore 14· not probed yet
lure words (login, verify, secure…) “update”TLD with a high abuse rate “xyz”
Lowexclaimquantum.xyzscore 14· not probed yet
lure words (login, verify, secure…) “claim”TLD with a high abuse rate “xyz”
Lowexistedpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexistspayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexpenseinvoice.xyzscore 14· not probed yet
lure words (login, verify, secure…) “invoice”TLD with a high abuse rate “xyz”
Lowexpensepayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexpensesecure.xyzscore 14· not probed yet
lure words (login, verify, secure…) “secure”TLD with a high abuse rate “xyz”
Lowexpensesverify.xyzscore 14· not probed yet
lure words (login, verify, secure…) “verify”TLD with a high abuse rate “xyz”
Lowexpenseverify.xyzscore 14· not probed yet
lure words (login, verify, secure…) “verify”TLD with a high abuse rate “xyz”
Lowexpertspayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexplainpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexploitsecure.xyzscore 14· not probed yet
lure words (login, verify, secure…) “secure”TLD with a high abuse rate “xyz”
Lowexploitverify.xyzscore 14· not probed yet
lure words (login, verify, secure…) “verify”TLD with a high abuse rate “xyz”
Lowexplorersecure.xyzscore 14· not probed yet
lure words (login, verify, secure…) “secure”TLD with a high abuse rate “xyz”
Lowexplorerverify.xyzscore 14· not probed yet
lure words (login, verify, secure…) “verify”TLD with a high abuse rate “xyz”
Lowexportinvoice.xyzscore 14· not probed yet
lure words (login, verify, secure…) “invoice”TLD with a high abuse rate “xyz”
Lowexportspayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowexposedpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowextendspayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowextentpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowextra-betwinner2399.topscore 14· boilerplate page
lure words (login, verify, secure…) “winner”TLD with a high abuse rate “top”
Lowextractinvoice.xyzscore 14· not probed yet
lure words (login, verify, secure…) “invoice”TLD with a high abuse rate “xyz”
Lowextractpayment.xyzscore 14· not probed yet
lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Lowextractrefund.xyzscore 14· not probed yet
lure words (login, verify, secure…) “refund”TLD with a high abuse rate “xyz”

Same data as JSON: /api/zone/risk?day=2026-09-21&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.