Flagged newborn domains, Thursday, October 1, 2026
2,948 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “support”brand name at a retail registrar “Sav.com, LLC”brand name at a watch-list registrar “Sav.com, LLC”
one-letter brand typo “mobile≈tmobile”brand plus digits “maxwin25-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand plus digits “maxwin25-mobile”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand spelled with digits “mgm8899mail→gmail”brand plus digits “mgm8899mail”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
brand in the name “microsoft”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “microsoft”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+1 more
brand in the name “microsoft”lure words (login, verify, secure…) “security”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”+2 more
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-agen338”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-popotogel00”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “google”lure words (login, verify, secure…) “support”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “cloudflare”brand plus digits “my-n8n-cloudflare”random-looking name “H=3.64”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “coinbase”lure words (login, verify, secure…) “wallet”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “neflix≈netflix”lure words (login, verify, secure…) “access,portal”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “netflix”lure words (login, verify, secure…) “billing,update”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
brand in the name “office365”brand plus digits “office365intuit”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “etsy”lure words (login, verify, secure…) “wallet”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand spelled with digits “outlierusa4→usaa”brand plus digits “outlierusa4”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “amazon”lure words (login, verify, secure…) “billing”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “adobe”many hyphens “3”very long name “29”brand plus digits “project-u488-adobeflder-hklhu”+4 more
brand in the name “vanguard”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+1 more
one-letter brand typo “revolt≈revolut”lure words (login, verify, secure…) “recover,recovery”brand name on a rarely-seen nameserver “arenhost.com”brand name at a retail registrar “TuringSign Inc. d/b/a Cosmotown”
brand in the name “revolut”TLD with a high abuse rate “xyz”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.Ş.”identical page on many newborns “61 identical pages”
Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.
brand in the name “robinhood”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Web Commerce Communications Limited dba ”+1 more
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Global Domain Group LLC”brand in page title, not in the name “cloudflare”+1 more
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
brand in the name “scotiabank”lure words (login, verify, secure…) “access”brand name at a retail registrar “OwnRegistrar, Inc.”
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “chase”lure words (login, verify, secure…) “login,secure,verify”many hyphens “7”very long name “52”+4 more
brand in the name “google”lure words (login, verify, secure…) “secure”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
brand in the name “icloud”lure words (login, verify, secure…) “secure”brand name at a retail registrar “Realtime Register B.V.”
brand in the name “cibc”lure words (login, verify, secure…) “portal,secure”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
Model opinion: looks like abuse (target: CIBC), confidence 85%. An opinion, not a finding.
brand in the name “facebook”lure words (login, verify, secure…) “security”TLD with a high abuse rate “bid”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “facebook”lure words (login, verify, secure…) “security”TLD with a high abuse rate “bid”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “google”lure words (login, verify, secure…) “service”brand name on a rarely-seen nameserver “nethost.in”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”brand name and brand-styled page “gmail”
Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.
brand in the name “shopify”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
brand in the name “shopify”brand plus digits “shopifypc1”brand in page title, not in the name “playstation”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Shopify), confidence 60%. An opinion, not a finding.
one-letter brand typo “shopsfy≈shopify”brand name at a retail registrar “Namify Domains Inc”brand in page title, not in the name “cloudflare”
Model opinion: looks like abuse (target: Shopify), confidence 55%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand plus digits “situs-mobile-gem188”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more
Model opinion: looks like abuse, confidence 74%. An opinion, not a finding.
brand in the name “roblox”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
one-letter brand typo “finance≈binance”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “starlink”brand name at a retail registrar “GoDaddy.com LLC”form on a brand-styled page “has_form”brand name redirects elsewhere “prom.ua”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand in the name “roblox”brand name at a retail registrar “Domain Science Kutatasi Szolgaltato Korl”brand name and brand-styled page “roblox”brand name redirects elsewhere “expireddomains.com”
Model opinion: looks like abuse (target: Roblox), confidence 72%. An opinion, not a finding.
one-letter brand typo “stride≈stripe”lure words (login, verify, secure…) “limited”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Same data as JSON: /api/zone/risk?day=2026-10-01&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.