Flagged newborn domains, Monday, September 28, 2026

2,000 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highchase-onlinebanking-verify.bondscore 55echoes chase· no DNS
brand in the name “chase”lure words (login, verify, secure…) “verify”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Chase (JPMorgan Chase)), confidence 80%. An opinion, not a finding.

Highchase-onlinebanking-verify.cyouscore 55echoes chase· no DNS
brand in the name “chase”lure words (login, verify, secure…) “verify”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: JPMorgan Chase), confidence 80%. An opinion, not a finding.

Highchase-secure-account-login.bondscore 55echoes chase· no DNS
brand in the name “chase”lure words (login, verify, secure…) “account,login,secure”many hyphens “3”TLD with a high abuse rate “bond”+1 more

Model opinion: looks like abuse (target: JPMorgan Chase), confidence 80%. An opinion, not a finding.

Highchase-secure-account-login.cyouscore 55echoes chase· no DNS
brand in the name “chase”lure words (login, verify, secure…) “account,login,secure”many hyphens “3”TLD with a high abuse rate “cyou”+1 more

Model opinion: looks like abuse (target: Chase (JPMorgan Chase)), confidence 75%. An opinion, not a finding.

Highcibc-smartalerts.comscore 55echoes cibc· empty page
brand in the name “cibc”lure words (login, verify, secure…) “alert,alerts”

Model opinion: looks like abuse (target: CIBC), confidence 72%. An opinion, not a finding.

Highcloud-arubaservices.comscore 55echoes icloud
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “service,services”

Model opinion: suspicious (target: icloud), confidence 52%. An opinion, not a finding.

Highcloudservicesoutlook.infoscore 55echoes outlook· no web server
brand in the name “outlook”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Microsoft), confidence 60%. An opinion, not a finding.

Highcoinbase-wallet.appscore 55echoes coinbase· boilerplate page
brand in the name “coinbase”lure words (login, verify, secure…) “wallet”identical page on many newborns “2879 identical pages”

Model opinion: looks like abuse (target: Coinbase), confidence 70%. An opinion, not a finding.

Highdataservicesoutlook.infoscore 55echoes outlook· no web server
brand in the name “outlook”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious, confidence 45%. An opinion, not a finding.

Highdigitalservicesoutlook.infoscore 55echoes outlook· no web server
brand in the name “outlook”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: Microsoft), confidence 50%. An opinion, not a finding.

Highdocsharepoint.topscore 55echoes sharepoint· boilerplate page
brand in the name “sharepoint”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+1 more

Model opinion: looks like phishing (target: Microsoft SharePoint), confidence 85%. An opinion, not a finding.

Highexpediacruises.teamscore 55echoes expedia· redirects elsewhere
brand in the name “expedia”brand name on a rarely-seen nameserver “rebel.com”brand name at a retail registrar “Super Registry Ltd”brand name and brand-styled page “expedia”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Highfaceb00k.proscore 55echoes facebook· boilerplate page
brand spelled with digits “faceb00k→facebook”brand plus digits “faceb00k”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Facebook), confidence 77%. An opinion, not a finding.

Highfacebook-login-verify.comscore 55echoes facebook
brand in the name “facebook”lure words (login, verify, secure…) “login,verify”

Model opinion: suspicious (target: facebook), confidence 72%. An opinion, not a finding.

Highfacebook-pay.clickscore 55echoes facebook· empty page
brand in the name “facebook”lure words (login, verify, secure…) “pay”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Facebook), confidence 74%. An opinion, not a finding.

Highfacebook-pay.xyzscore 55echoes facebook· empty page
brand in the name “facebook”lure words (login, verify, secure…) “pay”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Facebook), confidence 72%. An opinion, not a finding.

Highglobalglobal-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 70%. An opinion, not a finding.

Highgooglechrome858163.comscore 55echoes google
brand in the name “google”brand plus digits “googlechrome858163”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more

Model opinion: suspicious (target: google), confidence 56%. An opinion, not a finding.

Highgoogley123.comscore 55echoes google
brand in the name “google”brand plus digits “googley123”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “DEVEXPANSE LTD d/b/a Regery.com”+1 more

Model opinion: suspicious (target: google), confidence 60%. An opinion, not a finding.

Highgroupgroup-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 60%. An opinion, not a finding.

Highhelpdesk-lloydspayments.comscore 55echoes lloyds
brand in the name “lloyds”lure words (login, verify, secure…) “helpdesk,payment,payments”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: lloyds), confidence 71%. An opinion, not a finding.

Highhttps-admin-shopify-com-store-egwnwt-1n.storescore 55echoes shopify· other
brand in the name “shopify”many hyphens “6”very long name “39”brand plus digits “https-admin-shopify-com-store-egwnwt-1n”+1 more

Model opinion: looks like abuse (target: Shopify), confidence 80%. An opinion, not a finding.

Highicloudloginhelp.comscore 55echoes icloud· no DNS
brand in the name “icloud”lure words (login, verify, secure…) “login”

Model opinion: looks like abuse (target: Apple (iCloud)), confidence 72%. An opinion, not a finding.

Highidentification01-ledger.appscore 55echoes ledger· not probed yet
brand in the name “ledger”brand plus digits “identification01-ledger”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: unreachable when judged, confidence 45%. An opinion, not a finding.

Highilovemychatgpt.bondscore 55echoes chatgpt· registrar placeholder
brand in the name “chatgpt”TLD with a high abuse rate “bond”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: looks benign, confidence 68%. An opinion, not a finding.

Highinfoinfo-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 62%. An opinion, not a finding.

Highinquiries-trustwallet.netscore 55echoes trustwallet
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”free DNS provider “dnsowl.com”

Model opinion: suspicious (target: trustwallet), confidence 82%. An opinion, not a finding.

Highitausup.topscore 55echoes itau· boilerplate page
brand in the name “itau”TLD with a high abuse rate “top”brand name at a retail registrar “Dynadot LLC”brand name at a watch-list registrar “Dynadot LLC”+1 more

Model opinion: looks like abuse (target: Itaú Unibanco), confidence 70%. An opinion, not a finding.

Highlogin-microsoft-verify.onlinescore 55echoes microsoft· no DNS
brand in the name “microsoft”lure words (login, verify, secure…) “login,verify”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Microsoft), confidence 75%. An opinion, not a finding.

Highloginlogin-whatsapp.comscore 55echoes whatsapp
brand in the name “whatsapp”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: whatsapp), confidence 71%. An opinion, not a finding.

Highmainmain-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 60%. An opinion, not a finding.

Highmayun-alipay.momscore 55echoes alipay· blocked the probe
brand in the name “alipay”TLD with a high abuse rate “mom”brand name at a retail registrar “Key-Systems, LLC”brand name and brand-styled page “alipay”+1 more

Model opinion: looks like abuse (target: Alipay), confidence 72%. An opinion, not a finding.

Highmicrosoft-account.livescore 55echoes microsoft· boilerplate page
brand in the name “microsoft”lure words (login, verify, secure…) “account”identical page on many newborns “2879 identical pages”

Model opinion: looks like abuse (target: Microsoft), confidence 72%. An opinion, not a finding.

Highmobile-pay-dk.sitescore 55echoes tmobile· not probed yet
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “pay”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: MobilePay (Vipps MobilePay)), confidence 60%. An opinion, not a finding.

Highmobile-viewunlockportal-online.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “portal,unlock”very long name “30”

Model opinion: suspicious (target: tmobile), confidence 57%. An opinion, not a finding.

Highmyverified-shopify.comscore 55echoes shopify
brand in the name “shopify”lure words (login, verify, secure…) “verified”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: shopify), confidence 83%. An opinion, not a finding.

Highnaver-support.orgscore 55echoes naver· boilerplate page
brand in the name “naver”lure words (login, verify, secure…) “support”identical page on many newborns “2879 identical pages”

Model opinion: looks like abuse (target: Naver), confidence 70%. An opinion, not a finding.

Highnintendo-switch-tracker.comscore 55echoes nintendo
brand in the name “nintendo”lure words (login, verify, secure…) “track”

Model opinion: suspicious, confidence 63%. An opinion, not a finding.

Highno-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highofficialofficial-whatsapp.comscore 55echoes whatsapp
brand in the name “whatsapp”lure words (login, verify, secure…) “official”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: whatsapp), confidence 81%. An opinion, not a finding.

Highon-macrosoft-loginauth.xyzscore 55echoes microsoft· no web server
one-letter brand typo “macrosoft≈microsoft”lure words (login, verify, secure…) “login”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Microsoft), confidence 80%. An opinion, not a finding.

Highopenaiofficials.comscore 55echoes openai
brand in the name “openai”lure words (login, verify, secure…) “official”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”

Model opinion: suspicious (target: openai), confidence 78%. An opinion, not a finding.

Highpay-pal-l-k.netscore 55echoes paypal
brand in the name “paypal”lure words (login, verify, secure…) “pay”many hyphens “3”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: paypal), confidence 72%. An opinion, not a finding.

Highpaypalsupport-it.sitescore 55echoes paypal· no DNS
brand in the name “paypal”lure words (login, verify, secure…) “support”

Model opinion: looks like abuse (target: PayPal), confidence 77%. An opinion, not a finding.

Highportalportal-whatsapp.comscore 55echoes whatsapp
brand in the name “whatsapp”lure words (login, verify, secure…) “portal”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: whatsapp), confidence 81%. An opinion, not a finding.

Highpulsefit-shope.storescore 55echoes shopee· other
one-letter brand typo “shope≈shopee”brand name at a retail registrar “Namify Domains Inc”brand in page title, not in the name “cloudflare”

Model opinion: unreachable when judged, confidence 70%. An opinion, not a finding.

Highquickbookscleanupservices.comscore 55echoes quickbooks
brand in the name “quickbooks”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious, confidence 69%. An opinion, not a finding.

Highquickbookspayrollservice.comscore 55echoes quickbooks
brand in the name “quickbooks”lure words (login, verify, secure…) “service”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: quickbooks), confidence 78%. An opinion, not a finding.

Highrevolutionbd.xyzscore 55echoes revolut· boilerplate page
brand in the name “revolut”TLD with a high abuse rate “xyz”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.Ş.”identical page on many newborns “29 identical pages”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highrxtiktok.xyzscore 55echoes tiktok· no DNS
brand in the name “tiktok”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more

Model opinion: suspicious (target: TikTok), confidence 65%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-09-28&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.