Flagged newborn domains, Friday, September 25, 2026

870 names at tier high or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalpay-pal-agent.netscore 92echoes paypal· active website
brand in the name “paypal”lure words (login, verify, secure…) “pay”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”+1 more

Model opinion: looks like phishing (target: PayPal), confidence 97%. An opinion, not a finding.

Criticalinstagrab.downloadscore 80echoes instagram· active website
one-letter brand typo “instagrab≈instagram”TLD with a high abuse rate “download”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “instagram”+1 more

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticaldisneyfont.topscore 77echoes disney· active website
brand in the name “disney”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “disney”+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalverizonsupport.orgscore 76echoes verizon· active website
brand in the name “verizon”lure words (login, verify, secure…) “support”brand in page title, not in the name “wordpress”

Model opinion: looks like abuse (target: Verizon), confidence 80%. An opinion, not a finding.

Criticalchatgpt-wiki.comscore 74echoes chatgpt· active website
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “openai”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: OpenAI), confidence 58%. An opinion, not a finding.

Criticalshopeeribsgold.sitescore 74echoes shopee· active website
brand in the name “shopee”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Shopee), confidence 60%. An opinion, not a finding.

Criticaltelegram-online.orgscore 69echoes telegram· active website
brand in the name “telegram”brand name on a rarely-seen nameserver “dnspodsag.com”brand name and brand-styled page “telegram”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Telegram), confidence 86%. An opinion, not a finding.

Criticaltelegramsite.bizscore 69echoes telegram· active website
brand in the name “telegram”brand name and brand-styled page “telegram”form on a brand-styled page “has_form”form submits over plain HTTP “http://telegramsite.biz/”

Model opinion: looks like phishing (target: Telegram), confidence 95%. An opinion, not a finding.

Criticalbinancetrust.bondscore 68echoes binance· active website
brand in the name “binance”TLD with a high abuse rate “bond”brand name at a retail registrar “GLOBAL ASSET DOMAINS INC.”page impersonates a brand “Binance”

Model opinion: looks like a scam (target: Warden Protocol), confidence 88%. An opinion, not a finding.

Criticalc0scan.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “ledger”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticallotbook.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalpregrade.funscore 68· active website
TLD with a high abuse rate “fun”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticalsocialrise.clubscore 68· active website
page asks for credentials “Sign in to your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticaltarnsakr.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalbuzzycash.topscore 64· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”page pushes urgent payment “act Now”brand in page title, not in the name “paypal”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaletsydz.onlinescore 62echoes etsy· active website
brand in the name “etsy”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Etsy), confidence 62%. An opinion, not a finding.

Criticalrobloxopenchat.homesscore 62echoes roblox· active website
brand in the name “roblox”TLD with a high abuse rate “homes”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: MAX (VK messenger, max.ru)), confidence 93%. An opinion, not a finding.

Criticalstandtiktok.shopscore 62echoes tiktok· active website
brand in the name “tiktok”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: TikTok Shop), confidence 88%. An opinion, not a finding.

Criticalsterling-point-sezon-rf.autosscore 62echoes starling· active website
one-letter brand typo “sterling≈starling”many hyphens “3”TLD with a high abuse rate “autos”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalsupports-netflix.infoscore 62echoes netflix· active website
brand in the name “netflix”lure words (login, verify, secure…) “support”brand name on a rarely-seen nameserver “69host.cc”

Model opinion: looks like abuse (target: Netflix), confidence 80%. An opinion, not a finding.

Criticaltwinksexbox.clickscore 62echoes xbox· active website
brand in the name “xbox”TLD with a high abuse rate “click”brand name on a rarely-seen nameserver “xxxspot.click”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalaimjg.wikiscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalalaskankingbedsstore.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Alaskan King Bed Company), confidence 60%. An opinion, not a finding.

Criticalartemiszk.techscore 60· active website
page impersonates a brand “MetaMask”brand in page title, not in the name “uniswap”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalbinancechain.topscore 60echoes binance· active website
brand in the name “binance”TLD with a high abuse rate “top”page impersonates a brand “Binance”

Model opinion: looks like phishing (target: Warden Protocol), confidence 80%. An opinion, not a finding.

Criticalcrypto2giftcard.storescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalcrypto2giftcards.storescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalfomofied.familyscore 60· active website
page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalfraktbud.onlinescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalindustrieaustralia.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Industrie Clothing), confidence 72%. An opinion, not a finding.

Criticalmerryadvent.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalmobile-brio4dwd.orgscore 60echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-brio4dwd”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalnextstream.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalottocastcar.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Ottocast), confidence 70%. An opinion, not a finding.

Criticalpipfox.xyzscore 60· active website
TLD with a high abuse rate “xyz”page pushes urgent payment “guaranteed returns”brand in page title, not in the name “telegram”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalplanetcaravansmokeshopstore.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Planet Caravan Smoke Shop), confidence 70%. An opinion, not a finding.

Criticalschlossgartenmode.comscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalstraw-hat.storescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalsucessshine.comscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalteam24.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticaltesla.fooscore 60echoes tesla· active website
ambiguous brand word “tesla”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CloudFlare, Inc.”page impersonates a brand “Netflix”+1 more

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalyfdash.farmscore 60· active website
page impersonates a brand “MetaMask”brand in page title, not in the name “ledger”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Highamazon-usa.clickscore 59echoes amazon· active website
brand in the name “amazon”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “amazon”

Model opinion: looks like abuse (target: Amazon), confidence 80%. An opinion, not a finding.

Highrecargaunitvnowhatsapp.onlinescore 59echoes whatsapp· active website
brand in the name “whatsapp”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand name and brand-styled page “whatsapp”

Model opinion: looks like abuse, confidence 74%. An opinion, not a finding.

Highsalesforcegirl.orgscore 59echoes salesforce· active website
brand in the name “salesforce”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”brand name and brand-styled page “salesforce”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Hightiktokflow.sitescore 59echoes tiktok· active website
brand in the name “tiktok”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand name and brand-styled page “tiktok”

Model opinion: looks like abuse (target: TikTok), confidence 70%. An opinion, not a finding.

Hightiktokscheduler.appscore 59echoes tiktok· active website
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CloudFlare, Inc.”brand name and brand-styled page “tiktok”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highviralontiktok.storescore 59echoes tiktok· active website
brand in the name “tiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “tiktok”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highrpchub.topscore 58· active website
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”page impersonates a brand “MetaMask”brand in page title, not in the name “metamask”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Highaudit4u.orgscore 57echoes itau· active website
brand spelled with digits “audit4u→itau”brand plus digits “audit4u”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-25&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.