Flagged newborn domains, Friday, September 25, 2026

11,420 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Mediumroomway.sitescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumrumpel.funscore 30· active website
TLD with a high abuse rate “fun”page impersonates a brand “Office 365”
Mediumsalvationarmyshspta.comscore 30· active website
page asks for credentials “login to your account”
Mediumservicorapososadv.proscore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumshiba-inu.workscore 30· active website
TLD with a high abuse rate “work”page impersonates a brand “Binance”
Mediumshopifyhardwaresystem.shopscore 30echoes shopify· no web server
brand in the name “shopify”
Mediumsmartbuymarket.onlinescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumsmartderive.proscore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumsodatiide.storescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumsodatlde.storescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumsoddatide.storescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumstraata.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Mediumstraitofemotionsgmail.comscore 30echoes gmail
brand in the name “gmail”
Mediumsyncstatus.topscore 30· active website
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”login form “has_form+login words”
Mediumsynodmfast.onlinescore 30· active website
page asks for credentials “Login to Your Account”
Mediumt138bandarpgvip.websitescore 30· active website
page asks for credentials “Login to your Account”
Mediumtabletoptools.onlinescore 30· active website
page asks for credentials “Sign in to your account”
Mediumtanghouy.onlinescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumtearn.orgscore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumtechavenue.onlinescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumthekey.buzzscore 30· active website
TLD with a high abuse rate “buzz”page impersonates a brand “MetaMask”
Mediumtivinet.onlinescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumtkto.spacescore 30· active website
page asks for credentials “Verify your account”
Mediumtooniboy.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “NetFlix”
Mediumtribun138.websitescore 30· active website
page asks for credentials “Login to your Account”
Mediumtribun138wd.storescore 30· active website
page asks for credentials “Login to your Account”
Mediumtribun138wd.websitescore 30· active website
page asks for credentials “Login to your Account”
Mediumturbinebay.shopscore 30echoes ebay· boilerplate page
brand in the name “ebay”
Mediumvanguardplayops.comscore 30echoes vanguard
brand in the name “vanguard”
Mediumvanguardvision.shopscore 30echoes vanguard· no web server
brand in the name “vanguard”
Mediumvegasnow12.sitescore 30· active website
page asks for credentials “log in to your account”
Mediumverlexis.orgscore 30· active website
page asks for credentials “Log in to account”
Mediumvidaleve.cloudscore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumvivefire.onlinescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumvivianartstyle.storescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumwalmartfleetserices.comscore 30echoes walmart· no DNS
brand in the name “walmart”
Mediumwalmartfleetserivces.comscore 30echoes walmart
brand in the name “walmart”
Mediumwalmartfleetservces.comscore 30echoes walmart
brand in the name “walmart”
Mediumwalmartfleetservcies.comscore 30echoes walmart
brand in the name “walmart”
Mediumwalmartfleetsevices.comscore 30echoes walmart
brand in the name “walmart”
Mediumwebstuff.sitescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumwhatmovescrypto.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Binance”
Mediumwokeend.orgscore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumwoningwrasse.cfdscore 30· active website
TLD with a high abuse rate “cfd”page impersonates a brand “Apple ID”
Mediumworkday-report.comscore 30echoes workday
brand in the name “workday”
Mediumworld-offer.storescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumwtrxzone.onlinescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “66 identical pages”
Mediumxiaoyanbot.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Binance”
Mediumxn--p8sodx16a45bxv2amsl8k2acrk.topscore 30· no DNS
punycode name “鐵路結构數字孿生 scripts=CJK”very long name “30”TLD with a high abuse rate “top”
punycode name “和在江西成绩控制信号检测可能就自然科学 scripts=CJK”very long name “63”TLD with a high abuse rate “xyz”

Same data as JSON: /api/zone/risk?day=2026-09-25&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.