Flagged newborn domains, Saturday, September 26, 2026

2,201 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Mediumonlinelogin.xyzscore 34· empty page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumorder-id.buzzscore 34· blocked the probe
lure words (login, verify, secure…) “id”TLD with a high abuse rate “buzz”brand in page title, not in the name “cloudflare”
Mediumpr-gw-callback-27.xyzscore 34· blocked the probe
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumqaventa-finance.comscore 34echoes binance
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”
Mediumqaventa-finance.tradescore 34echoes binance· no DNS
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”
Mediumrevolutionhealthcareconsulting.comscore 34echoes revolut
brand in the name “revolut”very long name “30”
Mediumsales-forge.netscore 34echoes salesforce
one-letter brand typo “salesforge≈salesforce”brand name behind Cloudflare “cloudflare.com”
Mediumsetup-tiiktok.comscore 34echoes tiktok
one-letter brand typo “tiiktok≈tiktok”brand name behind Cloudflare “cloudflare.com”
Mediumstarklink.infoscore 34echoes starlink· not probed yet
one-letter brand typo “starklink≈starlink”brand name behind Cloudflare “cloudflare.com”
Mediumstipe.appscore 34echoes stripe· not probed yet
one-letter brand typo “stipe≈stripe”brand name behind Cloudflare “cloudflare.com”
Mediumt-cloud.appscore 34echoes icloud· empty page
one-letter brand typo “tcloud≈icloud”brand name behind Cloudflare “cloudflare.com”
Mediumtestbuy.storescore 34echoes bestbuy· server error
one-letter brand typo “testbuy≈bestbuy”brand name behind Cloudflare “cloudflare.com”
Mediumtrackwishtest.sbsscore 34· server error
lure words (login, verify, secure…) “track”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
Mediumusaarcheryfloridastateassociation.orgscore 34echoes usaa· blocked the probe
brand in the name “usaa”very long name “33”
Mediumverso-cloud.devscore 34echoes icloud· no DNS
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”
Mediumvvww-roblcx.comscore 34echoes roblox
one-letter brand typo “roblcx≈roblox”brand name behind Cloudflare “cloudflare.com”
Mediumwinance-exchange.onlinescore 34echoes binance· blocked the probe
one-letter brand typo “winance≈binance”brand name on a rarely-seen nameserver “vdsina.com”
Mediumwvvw-roblcx.comscore 34echoes roblox
one-letter brand typo “roblcx≈roblox”brand name behind Cloudflare “cloudflare.com”
Mediumzhuluojigongyuanshouyouxiazai.casascore 34echoes hulu· boilerplate page
brand in the name “hulu”very long name “29”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “9592 identical pages”
Mediumclaimeditofficial.onlinescore 32· active website
lure words (login, verify, secure…) “claim,official”brand in page title, not in the name “instagram”
Mediumeitservices.orgscore 32· active website
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
Mediumfbrewards.onlinescore 32· empty page
lure words (login, verify, secure…) “reward,rewards”brand in page title, not in the name “facebook”
Mediumfitrevolutionnowh5.sitescore 32echoes revolut· registrar placeholder
brand in the name “revolut”brand plus digits “fitrevolutionnowh5”identical page on many newborns “3588 identical pages”
Mediumheadlinemedia.livescore 32echoes lineme· active website
brand in the name “lineme”form on a brand-styled page “has_form”
Mediumlist654-voicecalls183-ready654-access.topscore 32· robots.txt denied
lure words (login, verify, secure…) “access”many hyphens “3”very long name “37”TLD with a high abuse rate “top”+1 more
Mediumlocalseoservices.proscore 32· active website
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
Mediumsouthardservices.storescore 32· other
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
Mediumtrackingcapi.onlinescore 32· active website
lure words (login, verify, secure…) “track,tracking”brand in page title, not in the name “whatsapp”
Mediumwebinterfacepayments.vipscore 32· empty page
lure words (login, verify, secure…) “payment,payments”brand in page title, not in the name “apple”
Mediumxn--22qr5k81xlpihsh7z7b.topscore 31· no DNS
punycode name “液相儀器預約 scripts=CJK”random-looking name “H=4.01”TLD with a high abuse rate “top”
Mediumxn--kpr97vov8bj3e.topscore 31· no DNS
punycode name “閑魚平台 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
Mediumxn--kpr97vz38blqf.topscore 31· no DNS
punycode name “闲鱼平台 scripts=CJK”random-looking name “H=3.91”TLD with a high abuse rate “top”
Mediumxn--tnq95p84ulpi6tjg72b.topscore 31· no DNS
punycode name “液相仪器预约 scripts=CJK”random-looking name “H=4.11”TLD with a high abuse rate “top”
Mediumableoutlook.comscore 30echoes outlook
brand in the name “outlook”
Mediumachadinhosdiarios.shopscore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “56 identical pages”
Mediumadobegroup.onlinescore 30echoes adobe· empty page
brand in the name “adobe”
Mediumaftertax.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “HMRC”
Mediumairbnboats.comscore 30echoes airbnb
brand in the name “airbnb”
Mediumalipayappkf.comscore 30echoes alipay
brand in the name “alipay”
Mediumalipayhkappkf.comscore 30echoes alipay
brand in the name “alipay”
Mediumalipayhkapponline.comscore 30echoes alipay· active website
brand in the name “alipay”
Mediumalipayhkf.comscore 30echoes alipay
brand in the name “alipay”
Mediumalveychart.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Mediumamazonbr.appscore 30echoes amazon· blocked the probe
brand in the name “amazon”
Mediumamazoncabin.comscore 30echoes amazon
brand in the name “amazon”
Mediumamazoncareers.onlinescore 30echoes amazon· no DNS
brand in the name “amazon”
Mediumamazoniapazarlama.comscore 30echoes amazon
brand in the name “amazon”
Mediumapp-spotify.onlinescore 30echoes spotify· not probed yet
brand in the name “spotify”
Mediumappwall.cyouscore 30· active website
TLD with a high abuse rate “cyou”page impersonates a brand “Apple ID”
Mediumateliersauge.topscore 30· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”

Same data as JSON: /api/zone/risk?day=2026-09-26&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.