one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “alert,alerts”many hyphens “3”TLD with a high abuse rate “cfd”+4 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand plus digits “ev99-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
brand in the name “fedex”lure words (login, verify, secure…) “track,tracking”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “fidelity”lure words (login, verify, secure…) “portal”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
one-letter brand typo “finance≈binance”many hyphens “3”very long name “42”TLD with a high abuse rate “bond”+2 more
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “wallet”many hyphens “4”very long name “34”+3 more
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1216 identical pages”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand spelled with digits “g00gle→google”brand plus digits “g00gle”brand name on a rarely-seen nameserver “apiname.com”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.Ş.”
brand in the name “ledger”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Highgoog1e.camscore 55echoes google· not probed yet brand spelled with digits “goog1e→google”brand plus digits “goog1e”TLD with a high abuse rate “cam”brand name behind Cloudflare “cloudflare.com”+1 more
one-letter brand typo “gooogle≈google”TLD with a high abuse rate “click”brand name at a retail registrar “Dynadot, LLC”brand name at a watch-list registrar “Dynadot, LLC”+1 more
Model opinion: looks like abuse (target: Google), confidence 72%. An opinion, not a finding.
brand in the name “venmo”very long name “31”brand plus digits “highways2heavenmoblieministries”brand name at a retail registrar “IONOS SE”+2 more
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “shopify”many hyphens “4”very long name “29”brand plus digits “https-ap51rb-ft-myshopify-com”+2 more
Model opinion: looks like abuse (target: Shopify), confidence 80%. An opinion, not a finding.
brand spelled with digits “icl0udid→icloud”brand plus digits “icl0udid”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
brand in the name “icloud”lure words (login, verify, secure…) “signin”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
brand in the name “instagram”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more
brand in the name “schwab”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “111 identical pages”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “usaa”TLD with a high abuse rate “beauty”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “uniswap”TLD with a high abuse rate “yachts”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
one-letter brand typo “starline≈starling”brand plus digits “king4k-starline”TLD with a high abuse rate “xyz”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “ledger”lure words (login, verify, secure…) “secure”
brand in the name “linkedin”lure words (login, verify, secure…) “support”brand name at a retail registrar “Squarespace Domains II LLC”
brand in the name “taobao”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-4frontcu”TLD with a high abuse rate “cfd”brand name at a retail registrar “Spaceship, Inc.”+3 more
Model opinion: looks like abuse (target: 4Front Credit Union), confidence 72%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “alert”brand plus digits “mobile-alert-4frontcu”TLD with a high abuse rate “cfd”+4 more
Model opinion: looks like abuse (target: 4Front Credit Union), confidence 80%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “alert”many hyphens “3”TLD with a high abuse rate “cfd”+4 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “alert,alerts”brand plus digits “mobile-alerts-4frontcu”TLD with a high abuse rate “cfd”+4 more
Model opinion: looks like abuse (target: 4Front Credit Union), confidence 80%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”lure words (login, verify, secure…) “alert,alerts”many hyphens “3”TLD with a high abuse rate “cfd”+4 more
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”+1 more
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-five88”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-site-76”brand name at a retail registrar “Automattic Inc.”form on a brand-styled page “has_form”+1 more
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “adobe”lure words (login, verify, secure…) “update”many hyphens “3”TLD with a high abuse rate “top”+3 more
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards2622”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards3668”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
very long name “29”TLD with a high abuse rate “sbs”free DNS provider “dnsowl.com”brand in page title, not in the name “google”+1 more
Model opinion: suspicious, confidence 68%. An opinion, not a finding.
brand in the name “shopify”brand name at a retail registrar “Namify Domains Inc”brand in page title, not in the name “cloudflare”
Model opinion: looks like abuse (target: Shopify), confidence 62%. An opinion, not a finding.
brand in the name “nubank”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse (target: Nubank), confidence 72%. An opinion, not a finding.
brand in the name “tiktok”lure words (login, verify, secure…) “official”brand name at a retail registrar “Squarespace Domains LLC”
one-letter brand typo “netflx≈netflix”lure words (login, verify, secure…) “payment,payments”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
one-letter brand typo “paypayl≈paypal”lure words (login, verify, secure…) “help”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand spelled with digits “phant0m→phantom”brand plus digits “phant0m”brand name at a retail registrar “Namify Domains Inc”identical page on many newborns “1412 identical pages”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “whatsapp”lure words (login, verify, secure…) “portal”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”
lure words (login, verify, secure…) “service”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand in page title, not in the name “google”+1 more
Model opinion: suspicious (target: Swiss public administration (ch.ch)), confidence 60%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GNAME.COM PTE. LTD.”+1 more
brand in the name “tmobile”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.
brand in the name “microsoft”lure words (login, verify, secure…) “support”brand name at a retail registrar “Squarespace Domains II LLC”
brand in the name “amazon”lure words (login, verify, secure…) “secure”TLD with a high abuse rate “icu”brand name at a retail registrar “Aceville Pte. Ltd.”
Model opinion: looks like phishing (target: AR24), confidence 70%. An opinion, not a finding.
brand in the name “authenticator”lure words (login, verify, secure…) “service”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “smbc”brand plus digits “smbcrad-jp2”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “2670 identical pages”
Model opinion: looks like abuse (target: SMBC (Sumitomo Mitsui Card)), confidence 80%. An opinion, not a finding.
brand in the name “usaa”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo”brand name at a watch-list registrar “NameSilo”+1 more
Model opinion: looks like abuse (target: Sonny Angel), confidence 72%. An opinion, not a finding.