Flagged newborn domains, Sunday, October 4, 2026
1,827 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
TLD with a high abuse rate “fun”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “fun”brand in page title, not in the name “uniswap”
TLD with a high abuse rate “fun”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “fun”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “lol”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “xyz”brand in page title, not in the name “phantom”
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “rest”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “sbs”brand in page title, not in the name “wordpress”
TLD with a high abuse rate “lol”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “sbs”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “sbs”brand in page title, not in the name “whatsapp”
TLD with a high abuse rate “cyou”brand in page title, not in the name “cloudflare”
one-letter brand typo “wawmart≈walmart”
TLD with a high abuse rate “xyz”brand in page title, not in the name “wordpress”
TLD with a high abuse rate “xyz”brand in page title, not in the name “facebook”
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “fun”brand in page title, not in the name “robinhood”
TLD with a high abuse rate “cyou”brand in page title, not in the name “google”
TLD with a high abuse rate “rest”brand in page title, not in the name “cloudflare”
punycode name “candelariamielycosmeticademontaña script”very long name “33”form submits over plain HTTP “http://xn--candelariamielycosmeticademon”
punycode name “cybersicherheit-für-kleine-firmen script”many hyphens “3”very long name “33”
TLD with a high abuse rate “cyou”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “mom”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “mom”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “win”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “cam”brand in page title, not in the name “whatsapp”
TLD with a high abuse rate “sbs”brand in page title, not in the name “telegram”
TLD with a high abuse rate “cyou”brand in page title, not in the name “google”
free DNS provider “dnsowl.com”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
TLD with a high abuse rate “fun”brand in page title, not in the name “google”
punycode name “โรงงานขายส่งเหล็ก scripts=THAI”very long name “30”random-looking name “H=4.14”
punycode name “청주센텀푸르지오 scripts=HANGUL”very long name “29”random-looking name “H=4.16”
punycode name “이브필라테스영등포 scripts=HANGUL”very long name “33”random-looking name “H=4.24”
punycode name “รับรูดบัตรเครดิตเป็นเงินสด scripts=THAI”very long name “41”random-looking name “H=3.91”
punycode name “แบล็คไลอ้อนรถเช่า scripts=THAI”very long name “31”random-looking name “H=3.98”
punycode name “重庆环宇铝材有限公司 scripts=CJK”very long name “36”random-looking name “H=4.35”
punycode name “超自然行动组咨询官网 scripts=CJK”very long name “34”random-looking name “H=4.20”
punycode name “超自然行动咨询官网 scripts=CJK”very long name “31”random-looking name “H=4.28”
punycode name “สล็อตเว็บตรงไทย scripts=THAI”very long name “28”random-looking name “H=3.79”
punycode name “ปิดโพรงบ้านเอ็นพีเอ็น scripts=THAI”very long name “34”random-looking name “H=4.20”
punycode name “브레인시티앤네이처미래도 scripts=HANGUL”very long name “40”random-looking name “H=4.50”
punycode name “泰隆康养产业集团 scripts=CJK”very long name “28”random-looking name “H=3.80”
punycode name “绿源现代农业发展 scripts=CJK”very long name “28”random-looking name “H=3.69”
punycode name “천안아산역이편한세상 scripts=HANGUL”very long name “32”random-looking name “H=4.22”
lure words (login, verify, secure…) “update”brand in page title, not in the name “telegram”
Same data as JSON: /api/zone/risk?day=2026-10-04&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.