Flagged newborn domains, Monday, September 21, 2026

29 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalpaypalreq.spacescore 85echoes paypal· active website
brand in the namepaypalpage impersonates a brandPayPalbrand name and brand-styled pagepaypalform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: PayPal), confidence 97%. An opinion, not a finding.

Criticalbestbuycanadas.comscore 77echoes bestbuy· active website
brand in the namebestbuybrand name at a retail registrarWeb Commerce Communications Limited dba brand name at a watch-list registrarWeb Commerce Communications Limited dba brand name and brand-styled pagebestbuy+1 more

Model opinion: looks like phishing (target: Best Buy), confidence 94%. An opinion, not a finding.

Criticalpaypalcasino.appscore 73echoes paypal· active website
brand in the namepaypalbrand name behind Cloudflarecloudflare.compage impersonates a brandpaypalbrand name and brand-styled pagepaypal

Model opinion: looks like abuse (target: PayPal), confidence 82%. An opinion, not a finding.

Criticalaxl777-mobile.xyzscore 69echoes tmobile· active website
brand spelled with digitsaxl777-mobile→tmobilebrand plus digitsaxl777-mobileTLD with a high abuse ratexyzform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 89%. An opinion, not a finding.

Criticaldora77-mobile.xyzscore 69echoes tmobile· active website
brand spelled with digitsdora77-mobile→tmobilebrand plus digitsdora77-mobileTLD with a high abuse ratexyzform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalsstiktok.appscore 69echoes tiktok· active website
brand in the nametiktokbrand name behind Cloudflarecloudflare.combrand name and brand-styled pagetiktokform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: TikTok), confidence 58%. An opinion, not a finding.

Criticalbestbuyhearing.onlinescore 68echoes bestbuy· active website
brand in the namebestbuybrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.brand name at a watch-list registrarNameCheap, Inc.+1 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalhdtv4k.xyzscore 68· active website
TLD with a high abuse ratexyzpage impersonates a brandnetflixbrand in page title, not in the namenetflixform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 96%. An opinion, not a finding.

Criticalonaircoins.comscore 68· active website
page asks for credentialsVerify your accountbrand in page title, not in the nameinstagramform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalpropassnp.xyzscore 68· active website
TLD with a high abuse ratexyzpage impersonates a brandNETFLIXbrand in page title, not in the namewhatsappform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalwhatsappnumberishere.shopscore 68echoes whatsapp· active website
brand in the namewhatsappbrand in page title, not in the namewordpressform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 52%. An opinion, not a finding.

Criticaltiptok.techscore 66echoes tiktok· active website
one-letter brand typotiptok≈tiktokbrand in page title, not in the nametiktokform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 58%. An opinion, not a finding.

Criticalroblox-high-school-2.wikiscore 65echoes roblox· active website
brand in the namerobloxmany hyphens3brand plus digitsroblox-high-school-2brand name behind Cloudflarecloudflare.com+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalthehuntroblox.wikiscore 65echoes roblox· active website
brand in the namerobloxbrand name behind Cloudflarecloudflare.combrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.+1 more

Model opinion: suspicious (target: Roblox), confidence 60%. An opinion, not a finding.

Criticaletsy-reverse-fee.onlinescore 63echoes etsy· active website
brand in the nameetsybrand name and brand-styled pageetsyform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalsamyagentewhatsapp.onlinescore 63echoes whatsapp· active website
brand in the namewhatsappbrand name and brand-styled pagewhatsappform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaltr3zor.netscore 63echoes trezor· active website
brand spelled with digitstr3zor→trezorbrand plus digitstr3zorbrand name behind Cloudflarecloudflare.combrand name at a retail registrarNameCheap, Inc.+1 more

Model opinion: looks like abuse (target: Trezor), confidence 75%. An opinion, not a finding.

Criticalvanguardstrength.storescore 63echoes vanguard· active website
brand in the namevanguardbrand name and brand-styled pagevanguardform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalwalmartvaluewithdraw.proscore 63echoes walmart· active website
brand in the namewalmartbrand name and brand-styled pagewalmartform on a brand-styled pagehas_form

Model opinion: looks like phishing (target: Walmart), confidence 62%. An opinion, not a finding.

Critical916-mobile-detail.netscore 62echoes tmobile· active website
one-letter brand typomobile≈tmobilebrand plus digits916-mobile-detailbrand name at a retail registrarHosting Concepts B.V. d/b/a Registrar.euform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 96%. An opinion, not a finding.

Criticalmytrustwallet.appscore 62echoes trustwallet· active website
brand in the nametrustwalletlure words (login, verify, secure…)walletbrand name on a rarely-seen nameserveroffsh.nl

Model opinion: looks like phishing (target: Trust Wallet), confidence 91%. An opinion, not a finding.

Criticaltubebay.storescore 62echoes ebay· active website
brand in the nameebaybrand name at a retail registrarSpaceship, Inc.brand name at a watch-list registrarSpaceship, Inc.form on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Criticalbalitrip.todayscore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namepaypalform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticaldeskbot.storescore 60· active website
page impersonates a brandCoinbasebrand in page title, not in the namerobinhoodform on a brand-styled pagehas_form

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Criticalmobile-reviews.sitescore 60echoes tmobile· active website
one-letter brand typomobile≈tmobilebrand name at a retail registrarHOSTINGER operations, UABbrand name at a watch-list registrarHOSTINGER operations, UABform on a brand-styled pagehas_form

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticalukestablishment.comscore 60· active website
page impersonates a brandHMRCbrand in page title, not in the namerevolutform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Criticalvelotrade.sitescore 60· active website
page impersonates a brandBinancebrand in page title, not in the namebinanceform on a brand-styled pagehas_form

Model opinion: looks like a scam, confidence 86%. An opinion, not a finding.

Criticalwingman.tradingscore 60· active website
page impersonates a brandCoinbasebrand in page title, not in the namecoinbaseform on a brand-styled pagehas_form

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Criticalyoutubenetworkcms.onlinescore 60· active website
page impersonates a brandPayPalbrand in page title, not in the namefacebookform on a brand-styled pagehas_form

Model opinion: looks like abuse (target: YouTube), confidence 68%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-21&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.