Flagged newborn domains, Wednesday, September 30, 2026
10,685 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
nameserver domain born the same day “rallydayinvestmentfund.com”
nameserver domain born the same day “rallydayfundmanagement.com”
nameserver domain born the same day “rallydayfundmanagement.com”
nameserver domain born the same day “rallydayfundmanagement.com”
nameserver domain born the same day “rallydayfundmanagement.com”
nameserver domain born the same day “rallydayfundmanagement.com”
nameserver domain born the same day “mydns01.info”
nameserver domain born the same day “sundarkhost.com”
random-looking name “H=4.17”brand in page title, not in the name “cloudflare”
nameserver domain born the same day “mydns01.info”
nameserver domain born the same day “yaroslist.org”
nameserver domain born the same day “lesta-tech.com”
lure words (login, verify, secure…) “confirm”many hyphens “3”very long name “30”TLD with a high abuse rate “bond”
very long name “31”brand in page title, not in the name “namecheap”
very long name “28”brand in page title, not in the name “namecheap”
brand in the name “revolut”identical page on many newborns “592 identical pages”
very long name “28”brand in page title, not in the name “whatsapp”
lure words (login, verify, secure…) “official”very long name “39”login form “has_form+login words”
very long name “32”brand in page title, not in the name “whatsapp”
brand in the name “ebay”very long name “29”brand name behind Cloudflare “cloudflare.com”
brand in the name “stripe”identical page on many newborns “182 identical pages”
lure words (login, verify, secure…) “login,portal,service”many hyphens “3”
brand in the name “venmo”identical page on many newborns “3701 identical pages”
brand in the name “icloud”identical page on many newborns “317 identical pages”
very long name “31”brand in page title, not in the name “chatgpt”
very long name “32”brand in page title, not in the name “cloudflare”
brand in the name “whatsapp”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”
very long name “35”brand in page title, not in the name “cloudflare”
punycode name “centre-de-traitement-unifié scripts=LATI”many hyphens “3”
punycode name “id医云 scripts=CJK/LATIN”lure words (login, verify, secure…) “id”
punycode name “pay-bitrefilľ scripts=LATIN”lure words (login, verify, secure…) “pay”
punycode name “森曜會所雲倉 scripts=CJK”random-looking name “H=4.01”
punycode name “เกมสล็อตไทย scripts=THAI”random-looking name “H=3.85”
punycode name “เที่ยวไปกินไป scripts=THAI”random-looking name “H=3.64”
punycode name “ตรวจหวยเช็คสลาก scripts=THAI”random-looking name “H=3.84”
punycode name “รุ้งโกลด์ scripts=THAI”random-looking name “H=3.72”
punycode name “กองทุนหมู่บ้าน scripts=THAI”random-looking name “H=3.89”
punycode name “全盘小纸条 scripts=CJK”random-looking name “H=3.62”
punycode name “墨韵书斋小说 scripts=CJK”random-looking name “H=3.78”
punycode name “北京迈镝盛科 scripts=CJK”random-looking name “H=3.91”
punycode name “송도한내들 scripts=HANGUL”random-looking name “H=3.68”
punycode name “모래내모발이식 scripts=HANGUL”random-looking name “H=4.18”
punycode name “정책배송 scripts=HANGUL”random-looking name “H=3.64”
punycode name “이루다하우스 scripts=HANGUL”random-looking name “H=3.79”
punycode name “부동산일빵빵 scripts=HANGUL”random-looking name “H=3.83”
punycode name “상인동밥집 scripts=HANGUL”random-looking name “H=3.73”
punycode name “서동탄역랜시티 scripts=HANGUL”random-looking name “H=4.08”
punycode name “상인동술집 scripts=HANGUL”random-looking name “H=4.17”
punycode name “상인동맛집 scripts=HANGUL”random-looking name “H=4.06”
punycode name “특수청소마루 scripts=HANGUL”random-looking name “H=4.01”
Same data as JSON: /api/zone/risk?day=2026-09-30&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.