Flagged newborn domains, Tuesday, September 22, 2026
10,662 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
brand in the name “usps”brand name behind Cloudflare “cloudflare.com”
brand in the name “usps”brand name behind Cloudflare “cloudflare.com”
brand in the name “usps”brand name behind Cloudflare “cloudflare.com”
brand in the name “usps”brand name behind Cloudflare “cloudflare.com”
brand in the name “usps”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “finance≈binance”brand name at a retail registrar “InterNetX GmbH”
one-letter brand typo “workeday≈workday”brand name at a retail registrar “Domain Science Kutatasi Szolgaltato Korl”
punycode name “adobé scripts=LATIN”brand in the name “adobe”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “disnéy scripts=LATIN”brand in the name “disney”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “facébook scripts=LATIN”brand in the name “facebook”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “linkédin scripts=LATIN”brand in the name “linkedin”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “nétflix scripts=LATIN”brand in the name “netflix”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “opénai scripts=LATIN”brand in the name “openai”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “telégram scripts=LATIN”brand in the name “telegram”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “twittér scripts=LATIN”brand in the name “twitter”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
punycode name “uniśwap scripts=LATIN”brand in the name “uniswap”brand name at a retail registrar “Tucows Domains Inc.”
one-letter brand typo “zoinbase≈coinbase”brand name at a retail registrar “Name.com, Inc.”
punycode name “超自然行动组申诉 scripts=CJK”very long name “29”random-looking name “H=3.91”TLD with a high abuse rate “xyz”
punycode name “내일이면끝하나주문세병발송 scripts=HANGUL”very long name “44”random-looking name “H=4.44”TLD with a high abuse rate “quest”
punycode name “人力资源职业能力测评中心 scripts=CJK”very long name “41”random-looking name “H=4.34”TLD with a high abuse rate “top”
lure words (login, verify, secure…) “limited”TLD with a high abuse rate “click”brand in page title, not in the name “google”
many hyphens “4”TLD with a high abuse rate “top”brand in page title, not in the name “wordpress”
lure words (login, verify, secure…) “track”TLD with a high abuse rate “xyz”brand in page title, not in the name “twitter”
lure words (login, verify, secure…) “track”TLD with a high abuse rate “fun”brand in page title, not in the name “twitter”
lure words (login, verify, secure…) “account”TLD with a high abuse rate “buzz”brand in page title, not in the name “ledger”
page pushes urgent payment “claim your bonus”brand in page title, not in the name “instagram”
TLD with a high abuse rate “cyou”nameserver domain born the same day “nqgso-12.com”
TLD with a high abuse rate “top”nameserver domain born the same day “nqgso-12.com”
TLD with a high abuse rate “icu”nameserver domain born the same day “nqgso-12.com”
TLD with a high abuse rate “cyou”nameserver domain born the same day “nqgso-12.com”
TLD with a high abuse rate “xyz”nameserver domain born the same day “kayviaweb.xyz”
TLD with a high abuse rate “icu”nameserver domain born the same day “nqgso-12.com”
TLD with a high abuse rate “click”nameserver domain born the same day “nqgso-12.com”
TLD with a high abuse rate “click”nameserver domain born the same day “nqgso-12.com”
TLD with a high abuse rate “top”nameserver domain born the same day “nqgso-12.com”
lure words (login, verify, secure…) “access,verify”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “uber”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “whatsapp”
lure words (login, verify, secure…) “reward,rewards”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “godaddy”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “whatsapp”
very long name “36”TLD with a high abuse rate “xyz”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “booking”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “wordpress”
punycode name “中国医药新闻 scripts=CJK”TLD with a high abuse rate “xyz”form submits over plain HTTP “http://xn--fiq06jptdd5t378a8ix.xyz/”
punycode name “中国医药新闻网 scripts=CJK”TLD with a high abuse rate “xyz”form submits over plain HTTP “http://xn--fiq06jptdd5tkh4awffwn0b.xyz/”
lure words (login, verify, secure…) “wallet”nameserver domain born the same day “adviceinsure.com”
punycode name “速智构维 scripts=CJK”random-looking name “H=3.66”TLD with a high abuse rate “top”
punycode name “送货端平台 scripts=CJK”random-looking name “H=3.81”TLD with a high abuse rate “fun”
Same data as JSON: /api/zone/risk?day=2026-09-22&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.