brand in the name “apple”lure words (login, verify, secure…) “id”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
Model opinion: looks like abuse (target: Apple), confidence 80%. An opinion, not a finding.
brand in the name “apple”lure words (login, verify, secure…) “pay”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+3 more
Model opinion: looks like abuse, confidence 86%. An opinion, not a finding.
brand in the name “authenticator”lure words (login, verify, secure…) “2fa”brand plus digits “authenticator-2fa”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “bbva”lure words (login, verify, secure…) “account”brand name at a retail registrar “Imperial Registrations, Inc.”
brand in the name “tmobile”many hyphens “3”very long name “28”TLD with a high abuse rate “top”+4 more
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
brand in the name “bestbuy”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand in page title, not in the name “hostinger”+1 more
Model opinion: looks benign, confidence 65%. An opinion, not a finding.
brand spelled with digits “bhs8c→hsbc”brand plus digits “bhs8c”TLD with a high abuse rate “beauty”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “spotify”lure words (login, verify, secure…) “billing”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “booking”lure words (login, verify, secure…) “winner”brand name at a retail registrar “Global Domain Group LLC”
brand in the name “roblox”many hyphens “4”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “alipay”lure words (login, verify, secure…) “pay”brand name at a retail registrar “Squarespace Domains LLC”
brand in the name “cashapp”lure words (login, verify, secure…) “customer,customers,support”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
brand in the name “chatgpt”TLD with a high abuse rate “xyz”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more
Model opinion: looks like abuse (target: OpenAI (ChatGPT)), confidence 70%. An opinion, not a finding.
brand in the name “cibc”lure words (login, verify, secure…) “verify”lure suffix “cibc-verifyid”brand name at a retail registrar “Gname.com Pte. Ltd.”+1 more
brand in the name “cibc”lure words (login, verify, secure…) “secure”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1345 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1345 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand plus digits “cloud-pay820”TLD with a high abuse rate “hair”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “cloudflare”lure words (login, verify, secure…) “reset”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
brand in the name “cloudflare”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: Cloudflare), confidence 72%. An opinion, not a finding.
brand in the name “coinbase”lure words (login, verify, secure…) “claim”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”
brand in the name “coinbase”lure words (login, verify, secure…) “wallet”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “coinbase”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: Coinbase), confidence 80%. An opinion, not a finding.
brand in the name “coinbase”lure words (login, verify, secure…) “validate”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “coinbase”lure words (login, verify, secure…) “wallet”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “costco”brand name on a rarely-seen nameserver “namespro.ca”brand name at a retail registrar “Namespro Solutions Inc.”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Costco), confidence 60%. An opinion, not a finding.
brand in the name “ebay”lure words (login, verify, secure…) “service”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
brand in the name “whatsapp”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “whatsapp”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: WhatsApp), confidence 62%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Hosting Ukraine LLC”
brand in the name “slack”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”+2 more
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “dropbox”lure words (login, verify, secure…) “billing”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
Model opinion: looks like phishing (target: Dropbox), confidence 70%. An opinion, not a finding.
brand spelled with digits “e75yl→etsy”brand plus digits “e75yl”TLD with a high abuse rate “top”brand name at a retail registrar “GoDaddy.com”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
Highe84yl.topscore 55echoes ebay· not probed yet brand spelled with digits “e84yl→ebay”brand plus digits “e84yl”TLD with a high abuse rate “top”brand name at a retail registrar “GoDaddy.com”
Highecloud.icuscore 55echoes icloud· boilerplate page one-letter brand typo “ecloud≈icloud”TLD with a high abuse rate “icu”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”+1 more
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “esukun-17tiktok”TLD with a high abuse rate “stream”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “facebook”brand name on a rarely-seen nameserver “icedns.is”brand name at a retail registrar “Internet Domain Service BS Corp”brand in page title, not in the name “google”+2 more
Model opinion: looks like abuse (target: Facebook), confidence 80%. An opinion, not a finding.
brand in the name “fedex”lure words (login, verify, secure…) “delivery”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “fidelity”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+2 more
brand in the name “fidelity”brand name at a retail registrar “DropCatch.com 872 LLC”identical page on many newborns “162 identical pages”brand name redirects elsewhere “dropcatch.com”
Model opinion: suspicious (target: Fidelity Investments), confidence 55%. An opinion, not a finding.
brand in the name “fidelity”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
one-letter brand typo “finance≈binance”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand spelled with digits “g00gles→google”brand plus digits “g00gles”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Global Domain Group LLC”
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1345 identical pages”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “google”lure words (login, verify, secure…) “security”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “google”lure words (login, verify, secure…) “verification”many hyphens “3”very long name “62”+4 more
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “google”brand plus digits “google0”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “google”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
brand in the name “google”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “google”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Global Domain Group LLC”
brand spelled with digits “haveit4u→itau”brand plus digits “haveit4u”brand name at a retail registrar “InterNetX GmbH”identical page on many newborns “184 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.