Flagged newborn domains, Thursday, October 1, 2026
1,241 names at tier high or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
one-letter brand typo “strive≈stripe”brand name at a retail registrar “Global Domains International, Inc. DBA D”form on a brand-styled page “has_form”brand name redirects elsewhere “domaincostclub.com”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Internet Domain Service BS Corp”
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “tax”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “hmrc”lure words (login, verify, secure…) “tax”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “fedex”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: FedEx), confidence 60%. An opinion, not a finding.
brand in the name “telegram”brand name at a retail registrar “DropCatch.com 1377 LLC”identical page on many newborns “171 identical pages”brand name redirects elsewhere “dropcatch.com”
Model opinion: looks like abuse (target: Telegram), confidence 60%. An opinion, not a finding.
brand in the name “telegram”lure words (login, verify, secure…) “member,members”brand name at a retail registrar “Register SPA”
brand in the name “telegram”lure words (login, verify, secure…) “member,members”brand name at a retail registrar “Register SPA”
Model opinion: looks benign, confidence 77%. An opinion, not a finding.
brand in the name “telegram”brand name at a retail registrar “DropCatch.com 1214 LLC”form on a brand-styled page “has_form”brand name redirects elsewhere “hugedomains.com”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand in the name “tiktok”lure words (login, verify, secure…) “reward,rewards”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
brand in the name “tiktok”brand plus digits “tiktokviking88”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+2 more
Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.
brand spelled with digits “towit4u→itau”brand plus digits “towit4u”brand name at a retail registrar “IONOS SE”identical page on many newborns “91 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Network Solutions, LLC”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name on a rarely-seen nameserver “regexdomain.com”brand name at a retail registrar “Global Domain Group LLC”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Squarespace Domains II LLC”
brand in the name “unicredit”TLD with a high abuse rate “cam”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+4 more
Model opinion: looks like abuse (target: UniCredit), confidence 80%. An opinion, not a finding.
brand in the name “uniswap”TLD with a high abuse rate “autos”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand in page title, not in the name “telegram”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “facebook”lure words (login, verify, secure…) “update”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “binance”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “facebook”lure words (login, verify, secure…) “verify”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “scotiabank”lure words (login, verify, secure…) “portal,verify”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
brand in the name “verizon”lure words (login, verify, secure…) “billing,customer”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “verizon”lure words (login, verify, secure…) “bonus”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: WhatsApp), confidence 72%. An opinion, not a finding.
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
brand in the name “whatsapp”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: WhatsApp), confidence 75%. An opinion, not a finding.
brand in the name “wechat”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand spelled with digits “wow77mobile→tmobile”brand plus digits “wow77mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “xbox”brand plus digits “xbox6”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot LLC.”+1 more
brand in the name “xbox”lure words (login, verify, secure…) “authenticate”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
punycode name “konto-prüfung-handel-id-mobile scripts=L”one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “id”many hyphens “4”+3 more
punycode name “sparkassen-überweisung scripts=LATIN”brand in the name “sparkasse”brand name at a retail registrar “Name.com, Inc.”
brand in the name “tiktok”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”identical page on many newborns “45 identical pages”
Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.
brand in the name “adobe”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
brand in the name “adobe”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
brand in the name “adobe”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
brand in the name “bybit”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
Model opinion: looks like abuse (target: Bybit), confidence 72%. An opinion, not a finding.
brand in the name “bybit”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
brand in the name “bybit”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
brand in the name “bybit”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
Model opinion: looks like abuse (target: Bybit), confidence 60%. An opinion, not a finding.
brand in the name “ebay”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
Model opinion: looks benign, confidence 86%. An opinion, not a finding.
brand in the name “binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “OwnRegistrar Inc.”identical page on many newborns “42 identical pages”
Model opinion: looks like abuse (target: Binance), confidence 75%. An opinion, not a finding.
brand in the name “chatgpt”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “2249 identical pages”
Model opinion: looks like abuse (target: OpenAI (ChatGPT)), confidence 60%. An opinion, not a finding.
brand in the name “zelle”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand in the name “zelle”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
brand in the name “zelle”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
brand in the name “zelle”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4845 identical pages”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
Same data as JSON: /api/zone/risk?day=2026-10-01&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.