Flagged newborn domains, Monday, October 5, 2026
1,805 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
brand in the name “spectrum”lure words (login, verify, secure…) “official”brand name at a retail registrar “Squarespace Domains II LLC”
one-letter brand typo “starlings≈starling”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
brand in the name “starlink”brand plus digits “starlink4dokidoki”TLD with a high abuse rate “beauty”brand name behind Cloudflare “cloudflare.com”+2 more
Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.
brand in the name “gmail”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Internet Domain Service BS Corp”
brand in the name “google”lure words (login, verify, secure…) “support”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “netflix”lure words (login, verify, secure…) “support”brand name at a retail registrar “OVH sas”
brand in the name “netflix”lure words (login, verify, secure…) “support”brand name at a retail registrar “OVH sas”
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”+3 more
Model opinion: looks like abuse (target: Telegram), confidence 77%. An opinion, not a finding.
brand in the name “coinbase”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”+1 more
Model opinion: looks like abuse (target: TikTok), confidence 80%. An opinion, not a finding.
brand in the name “taobao”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
brand in the name “paypal”lure words (login, verify, secure…) “track,tracking”brand plus digits “tracking2paypal”brand name behind Cloudflare “cloudflare.com”+2 more
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “tiktok”lure words (login, verify, secure…) “service”TLD with a high abuse rate “top”brand name at a retail registrar “Dynadot LLC”+2 more
Model opinion: looks like abuse (target: TikTok), confidence 72%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Key-Systems GmbH”identical page on many newborns “32 identical pages”
Model opinion: looks like phishing (target: Trust Wallet), confidence 86%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Key-Systems GmbH”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Key-Systems GmbH”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”+2 more
Model opinion: looks like abuse (target: Trust Wallet), confidence 80%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Key-Systems GmbH”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “Key-Systems GmbH”
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v1”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v10”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v11”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v12”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v13”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v14”+1 more
Model opinion: looks like abuse (target: Uniswap), confidence 82%. An opinion, not a finding.
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v15”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v16”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v17”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v18”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v19”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v2”+1 more
brand in the name “uniswap”many hyphens “3”very long name “30”brand plus digits “uniswap-protocol-interface-v20”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v3”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v4”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v5”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v6”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v7”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v8”+1 more
brand in the name “uniswap”many hyphens “3”very long name “29”brand plus digits “uniswap-protocol-interface-v9”+1 more
brand in the name “vanguard”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo,LLC”+1 more
brand in the name “vanguard”lure words (login, verify, secure…) “delivery”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “tiktok”+2 more
Model opinion: looks like abuse (target: TikTok), confidence 70%. An opinion, not a finding.
brand spelled with digits “web4y→ebay”brand plus digits “web4y”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+2 more
Model opinion: looks benign, confidence 65%. An opinion, not a finding.
brand in the name “whatsapp”lure words (login, verify, secure…) “portal”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Guizhou Zhongyu Zhike Network Technology”
brand in the name “wellsfargo”lure words (login, verify, secure…) “alert”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
one-letter brand typo “whatsap≈whatsapp”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “whatsapp”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “whatsapp”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+1 more
Same data as JSON: /api/zone/risk?day=2026-10-05&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.