Flagged newborn domains, Wednesday, September 30, 2026
10,685 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “마포치과 scripts=HANGUL”random-looking name “H=3.64”
punycode name “城宇工程实业 scripts=CJK”random-looking name “H=3.92”
punycode name “대성휀스 scripts=HANGUL”random-looking name “H=3.62”
punycode name “평생대물 scripts=HANGUL”random-looking name “H=3.77”
punycode name “대물주소 scripts=HANGUL”random-looking name “H=3.77”
punycode name “대물평생주소 scripts=HANGUL”random-looking name “H=4.19”
punycode name “대물평생 scripts=HANGUL”random-looking name “H=3.77”
punycode name “대물평생도메인 scripts=HANGUL”random-looking name “H=3.97”
punycode name “대물도메인 scripts=HANGUL”random-looking name “H=3.61”
punycode name “澜海生鲜供应链 scripts=CJK”random-looking name “H=4.02”
punycode name “凯新能源 scripts=CJK”random-looking name “H=3.64”
punycode name “当宁消防网 scripts=CJK”random-looking name “H=4.06”
punycode name “数字资产 scripts=CJK”random-looking name “H=3.88”
punycode name “优质土特产 scripts=CJK”random-looking name “H=3.95”
punycode name “产品溯源平台 scripts=CJK”random-looking name “H=3.88”
punycode name “产品追溯平台 scripts=CJK”random-looking name “H=4.10”
punycode name “新型电池 scripts=CJK”random-looking name “H=3.64”
punycode name “隐麓红庄 scripts=CJK”random-looking name “H=3.64”
punycode name “윤림상품권 scripts=HANGUL”random-looking name “H=3.68”
punycode name “메이드상품권 scripts=HANGUL”random-looking name “H=3.92”
punycode name “양산힐스테이트 scripts=HANGUL”random-looking name “H=4.17”
punycode name “重庆自建房 scripts=CJK”random-looking name “H=3.73”
TLD with a high abuse rate “monster”page pushes urgent payment “Claim Your Bonus”
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “account,accounts,limited”very long name “32”
brand in the name “itau”TLD with a high abuse rate “xyz”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “customer,customers,service”very long name “34”
page impersonates a brand “IRS”
TLD with a high abuse rate “xyz”login form “has_form+login words”
TLD with a high abuse rate “work”login form “has_form+login words”
page impersonates a brand “Bank of America”
page impersonates a brand “MetaMask”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “Microsoft 365”
page impersonates a brand “IRS”
TLD with a high abuse rate “monster”page pushes urgent payment “Claim Your Bonus”
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”form submits over plain HTTP “http://awastar.top/”
page impersonates a brand “Microsoft 365”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
many hyphens “3”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
lure words (login, verify, secure…) “service,services,support”very long name “31”
lure words (login, verify, secure…) “billing”TLD with a high abuse rate “cyou”free DNS provider “dnsowl.com”
lure words (login, verify, secure…) “billing”TLD with a high abuse rate “sbs”free DNS provider “dnsowl.com”
lure words (login, verify, secure…) “billing”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
Same data as JSON: /api/zone/risk?day=2026-09-30&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.