Flagged newborn domains, Saturday, September 26, 2026

2,201 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highquickbooksschedulingservice.comscore 55echoes quickbooks
brand in the name “quickbooks”lure words (login, verify, secure…) “service”

Model opinion: suspicious (target: quickbooks), confidence 73%. An opinion, not a finding.

Highrakuten-osusume-room.infoscore 55echoes rakuten· redirects elsewhere
brand in the name “rakuten”form on a brand-styled page “has_form”brand name redirects elsewhere “puchipura-lovers.info”

Model opinion: looks like abuse (target: Rakuten), confidence 55%. An opinion, not a finding.

Highsecure-tiktok.comscore 55echoes tiktok
brand in the name “tiktok”lure words (login, verify, secure…) “secure”

Model opinion: suspicious (target: tiktok), confidence 91%. An opinion, not a finding.

Highsicypiebay.autosscore 55echoes ebay· robots.txt denied
brand in the name “ebay”TLD with a high abuse rate “autos”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more

Model opinion: suspicious (target: ebay), confidence 41%. An opinion, not a finding.

Highsmbcrad-1jp.ripscore 55echoes smbc· boilerplate page
brand in the name “smbc”brand plus digits “smbcrad-1jp”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “2755 identical pages”

Model opinion: looks like abuse (target: SMBC (Sumitomo Mitsui Card)), confidence 80%. An opinion, not a finding.

Highstarlink-market.onlinescore 55echoes starlink· redirects elsewhere
brand in the name “starlink”brand name and brand-styled page “starlink”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Starlink), confidence 70%. An opinion, not a finding.

Highsupport-icloud.contactscore 55echoes icloud· not probed yet
brand in the name “icloud”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Apple (iCloud)), confidence 70%. An opinion, not a finding.

Highsupport-spotify.comscore 55echoes spotify
brand in the name “spotify”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: spotify), confidence 84%. An opinion, not a finding.

Highsupportfacebook.autosscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “autos”

Model opinion: looks like abuse (target: Facebook), confidence 72%. An opinion, not a finding.

Highsupportfacebook.beautyscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “beauty”brand name at a retail registrar “Dynadot Inc”+1 more

Model opinion: looks like abuse (target: Facebook), confidence 75%. An opinion, not a finding.

Highsupportfacebook.bizscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”

Model opinion: looks like abuse (target: Facebook), confidence 75%. An opinion, not a finding.

Highsupportfacebook.clickscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “click”

Model opinion: looks like abuse (target: Facebook (Meta)), confidence 77%. An opinion, not a finding.

Highsupportfacebook.homesscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “homes”

Model opinion: looks like abuse (target: Facebook), confidence 75%. An opinion, not a finding.

Highsupportfacebook.latscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”

Model opinion: looks like abuse (target: Facebook (Meta)), confidence 75%. An opinion, not a finding.

Highsupportfacebook.lolscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “lol”

Model opinion: looks like abuse (target: Facebook), confidence 72%. An opinion, not a finding.

Highsupportfacebook.monsterscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “monster”

Model opinion: looks like abuse (target: Facebook), confidence 75%. An opinion, not a finding.

Highsupportfacebook.picsscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”

Model opinion: looks like abuse (target: Facebook (Meta)), confidence 75%. An opinion, not a finding.

Highsupportfacebook.questscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “quest”

Model opinion: looks like abuse (target: Facebook), confidence 80%. An opinion, not a finding.

Highsupportfacebook.sbsscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “sbs”

Model opinion: looks like abuse (target: Facebook (Meta)), confidence 77%. An opinion, not a finding.

Highsupportfacebook.xyzscore 55echoes facebook· no web server
brand in the name “facebook”lure words (login, verify, secure…) “support”TLD with a high abuse rate “xyz”

Model opinion: looks like abuse (target: Facebook), confidence 72%. An opinion, not a finding.

Highsupportrobinhood247.onlinescore 55echoes robinhood· robots.txt denied
brand in the name “robinhood”lure words (login, verify, secure…) “support”brand plus digits “supportrobinhood247”brand name at a retail registrar “HOSTINGER operations, UAB”+1 more

Model opinion: suspicious (target: Robinhood), confidence 72%. An opinion, not a finding.

Highsupprorttrustwallet.comscore 55echoes trustwallet
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”free DNS provider “dnsowl.com”

Model opinion: suspicious (target: trustwallet), confidence 85%. An opinion, not a finding.

Hightelegrambonusgruplari.comscore 55echoes telegram
brand in the name “telegram”lure words (login, verify, secure…) “bonus”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious, confidence 77%. An opinion, not a finding.

Hightiktok-emojis.comscore 55echoes tiktok· suspended
brand in the name “tiktok”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Hightiktok88skw.livescore 55echoes tiktok· not probed yet
brand in the name “tiktok”brand plus digits “tiktok88skw”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: suspicious (target: tiktok), confidence 54%. An opinion, not a finding.

Hightrezorwalletsuite.comscore 55echoes trezor
brand in the name “trezor”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: trezor), confidence 77%. An opinion, not a finding.

Highvanguardcasino.clickscore 55echoes vanguard· server error
brand in the name “vanguard”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+1 more

Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.

Highverified-business.topscore 55· redirects elsewhere
lure words (login, verify, secure…) “verified”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand in page title, not in the name “facebook”+1 more

Model opinion: suspicious (target: Meta (Facebook)), confidence 60%. An opinion, not a finding.

Highverizonrewardsjoin.comscore 55echoes verizon
brand in the name “verizon”lure words (login, verify, secure…) “reward,rewards”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: verizon), confidence 85%. An opinion, not a finding.

Highvulkan24-mobile.funscore 55echoes tmobile· not probed yet
one-letter brand typo “mobile≈tmobile”brand plus digits “vulkan24-mobile”TLD with a high abuse rate “fun”brand name at a retail registrar “Dynadot Inc”+1 more

Model opinion: suspicious (target: tmobile), confidence 44%. An opinion, not a finding.

Highwalmartfleetservices.netscore 55echoes walmart· no DNS
brand in the name “walmart”lure words (login, verify, secure…) “service,services”

Model opinion: looks like abuse (target: Walmart), confidence 55%. An opinion, not a finding.

Highwhatsapp-scam.blogscore 55echoes whatsapp· boilerplate page
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun, LLC”brand name at a watch-list registrar “Porkbun, LLC”+1 more

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Highwin-strike.comscore 55echoes stripe
one-letter brand typo “strike≈stripe”lure words (login, verify, secure…) “win”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: stripe), confidence 43%. An opinion, not a finding.

Highwordpressmanagementservices.comscore 55echoes wordpress
brand in the name “wordpress”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Highwordpresswebsitedevelopmentservices.comscore 55echoes wordpress
brand in the name “wordpress”lure words (login, verify, secure…) “service,services”very long name “35”

Model opinion: looks benign, confidence 63%. An opinion, not a finding.

Highzellebusinesspaysupport.comscore 55echoes zelle
brand in the name “zelle”lure words (login, verify, secure…) “support”

Model opinion: suspicious (target: zelle), confidence 85%. An opinion, not a finding.

High420-cloud.xyzscore 54echoes icloud· boilerplate page
one-letter brand typo “cloud≈icloud”brand plus digits “420-cloud”TLD with a high abuse rate “xyz”identical page on many newborns “2755 identical pages”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highbarun-finance.comscore 54echoes binance· active website
one-letter brand typo “finance≈binance”brand name at a retail registrar “Squarespace Domains LLC”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highgestaoseguro.topscore 54· active website
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Highgogle.helpscore 54echoes google· server error
one-letter brand typo “gogle≈google”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”

Model opinion: looks like abuse (target: Google), confidence 72%. An opinion, not a finding.

Highhappyhousecleaningservicesoman.comscore 54· active website
lure words (login, verify, secure…) “service,services”very long name “30”brand in page title, not in the name “booking”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highhttps-winance.exchangescore 54echoes binance· active website
one-letter brand typo “winance≈binance”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Highiqgmail.xyzscore 54echoes gmail· parked, for sale
brand in the name “gmail”TLD with a high abuse rate “xyz”brand name at a retail registrar “NicNames, Inc.”brand name redirects elsewhere “nic.ua”

Model opinion: looks like abuse (target: Gmail (Google)), confidence 60%. An opinion, not a finding.

Highlogin-winance.exchangescore 54echoes binance· not probed yet
one-letter brand typo “winance≈binance”lure words (login, verify, secure…) “login”

Model opinion: looks like abuse (target: Binance), confidence 75%. An opinion, not a finding.

Highmeet-krtqw-google.livescore 54echoes google· empty page
brand in the name “google”brand name on a rarely-seen nameserver “vdsina.com”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Google), confidence 77%. An opinion, not a finding.

Higholdmoney.hairscore 54· active website
TLD with a high abuse rate “hair”free DNS provider “dnsowl.com”brand in page title, not in the name “halifax”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highsecurewordpresshosting.comscore 54echoes wordpress
brand in the name “wordpress”lure words (login, verify, secure…) “secure”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highshopes.onlinescore 54echoes shopee· placeholder page
one-letter brand typo “shopes≈shopee”brand name at a retail registrar “Name.com, Inc.”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highstarting-block-pmu.onlinescore 54echoes starling· active website
one-letter brand typo “starting≈starling”brand name at a retail registrar “Name.com, Inc.”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Hightiktok88viking.worldscore 54echoes tiktok· boilerplate page
brand in the name “tiktok”brand plus digits “tiktok88viking”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “44 identical pages”

Model opinion: looks like abuse (target: TikTok), confidence 62%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-26&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.