Flagged newborn domains, Tuesday, September 22, 2026
10,662 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
nameserver domain born the same day “asttwhdns.com”
nameserver domain born the same day “uctesesrmdns.com”
nameserver domain born the same day “nqgso-12.com”
lure words (login, verify, secure…) “alert,secure”very long name “36”TLD with a high abuse rate “xyz”
very long name “29”brand in page title, not in the name “zoom”
very long name “30”brand in page title, not in the name “cloudflare”
very long name “45”brand in page title, not in the name “cloudflare”
very long name “28”brand in page title, not in the name “tiktok”
brand in the name “lineme”identical page on many newborns “2762 identical pages”
brand in the name “revolut”identical page on many newborns “36 identical pages”
brand in the name “revolut”identical page on many newborns “299 identical pages”
brand in the name “revolut”identical page on many newborns “299 identical pages”
brand in the name “chatgpt”identical page on many newborns “80 identical pages”
punycode name “قرار-واستقرار-لعلاج-الادمان scripts=ARAB”many hyphens “3”
punycode name “민머루잼머 scripts=HANGUL”form submits over plain HTTP “http://xn--2s2b1xba91p13z.shop/”
punycode name “끌리오 scripts=HANGUL”form submits over plain HTTP “http://xn--3z0bv1pvnk.shop/”
punycode name “f5새로고침 scripts=HANGUL/LATIN”form submits over plain HTTP “http://xn--f5-qc2ik39a8hk9ru.shop/”
punycode name “왁싱브리즈 scripts=HANGUL”form submits over plain HTTP “http://xn--oy2b13fn5e51d75e.shop/”
punycode name “pay-bițŗefill scripts=LATIN”lure words (login, verify, secure…) “pay”
punycode name “pay-bitŗefill scripts=LATIN”lure words (login, verify, secure…) “pay”
punycode name “primstädservice scripts=LATIN”lure words (login, verify, secure…) “service”
punycode name “xümplürofficial scripts=LATIN”lure words (login, verify, secure…) “official”
very long name “29”random-looking name “H=4.07”login form “has_form+login words”
many hyphens “4”very long name “57”random-looking name “H=3.65”TLD with a high abuse rate “click”
punycode name “レズ風俗 scripts=CJK/KATAKANA”random-looking name “H=3.64”
punycode name “รับสร้างคลินิก scripts=THAI”random-looking name “H=3.91”
punycode name “北京健康 scripts=CJK”random-looking name “H=3.66”
punycode name “바르다모터스 scripts=HANGUL”random-looking name “H=3.82”
punycode name “서울부동산 scripts=HANGUL”random-looking name “H=3.97”
punycode name “체험활동 scripts=HANGUL”random-looking name “H=3.88”
punycode name “반려동물 scripts=HANGUL”random-looking name “H=3.77”
punycode name “피씨솔루션 scripts=HANGUL”random-looking name “H=3.84”
punycode name “영등포영어회화 scripts=HANGUL”random-looking name “H=3.88”
punycode name “원디자인 scripts=HANGUL”random-looking name “H=3.77”
punycode name “หลอมทองนครปฐม scripts=THAI”random-looking name “H=3.88”
punycode name “אלביוסדון scripts=HEBREW”random-looking name “H=3.66”
punycode name “김보일논술 scripts=HANGUL”random-looking name “H=3.95”
punycode name “海南自贸港非遗 scripts=CJK”random-looking name “H=4.16”
punycode name “海南非遗网址 scripts=CJK”random-looking name “H=3.88”
punycode name “ช่างรื้อถอน scripts=THAI”random-looking name “H=3.75”
punycode name “รับจํานําพัทยา scripts=THAI”random-looking name “H=3.97”
punycode name “红果免费漫剧 scripts=CJK”random-looking name “H=3.92”
punycode name “안덕농협유통 scripts=HANGUL”random-looking name “H=3.79”
punycode name “연금보험비교 scripts=HANGUL”random-looking name “H=4.11”
punycode name “아이스평생 scripts=HANGUL”random-looking name “H=3.73”
punycode name “평생아이스 scripts=HANGUL”random-looking name “H=3.84”
punycode name “패스트오더봇 scripts=HANGUL”random-looking name “H=4.07”
punycode name “원탑영어수학학원 scripts=HANGUL”random-looking name “H=3.82”
punycode name “雪阿吉拉姆 scripts=CJK”random-looking name “H=4.06”
punycode name “옥수수연료 scripts=HANGUL”random-looking name “H=3.62”
Same data as JSON: /api/zone/risk?day=2026-09-22&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.