Flagged newborn domains, Monday, October 5, 2026

1,805 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalgmailios.topscore 93echoes gmail· active website
brand in the name “gmail”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo,LLC”+3 more

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticalvanguardaiinfo.clickscore 91echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+3 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalvanguardbizsolutions.sbsscore 91echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalamazon789.winscore 78echoes amazon· active website
brand in the name “amazon”brand plus digits “amazon789”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalstarlinkuganda.orgscore 77echoes starlink· active website
brand in the name “starlink”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”brand name and brand-styled page “starlink”+1 more

Model opinion: looks like phishing (target: Starlink), confidence 85%. An opinion, not a finding.

Criticalem-telegram.sbsscore 73echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+2 more

Model opinion: looks like abuse (target: Telegram), confidence 86%. An opinion, not a finding.

Criticales-telegram.sbsscore 73echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+2 more

Model opinion: looks like abuse (target: Telegram), confidence 86%. An opinion, not a finding.

Criticalclinicadentalsantander.comscore 71echoes santander· active website
brand in the name “santander”brand name at a retail registrar “10dencehispahard SLU”brand name and brand-styled page “santander”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticaldrill-for-eggs-roblox.wikiscore 71echoes roblox· active website
brand in the name “roblox”many hyphens “3”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+2 more

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticallearnsalesforce.sitescore 71echoes salesforce· active website
brand in the name “salesforce”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “salesforce”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticale-inviteonline.sbsscore 68· active website
TLD with a high abuse rate “sbs”page impersonates a brand “Office365”brand in page title, not in the name “adobe”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Adobe), confidence 97%. An opinion, not a finding.

Criticalmp4bua.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 93%. An opinion, not a finding.

Criticalsocial-trendo.storescore 68· active website
page asks for credentials “SIGN IN TO YOUR ACCOUNT”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 77%. An opinion, not a finding.

Criticalcanaux-telegram-sexe.streamscore 67echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “stream”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”+1 more

Model opinion: looks like abuse, confidence 66%. An opinion, not a finding.

Criticalrobloxmym.xyzscore 67echoes roblox· active website
brand in the name “roblox”TLD with a high abuse rate “xyz”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more

Model opinion: looks like a scam (target: Roblox), confidence 80%. An opinion, not a finding.

Criticaltopup-india.cfdscore 66· active website
TLD with a high abuse rate “cfd”page asks for credentials “Verify your account”page pushes urgent payment “LIMITED TIME OFFER”login form “has_form+login words”

Model opinion: looks like phishing (target: Garena (Free Fire)), confidence 86%. An opinion, not a finding.

Criticalrobloxguide.wikiscore 65echoes roblox· active website
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalstealacar-roblox.wikiscore 65echoes roblox· active website
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalshopifyauditadmin.storescore 64echoes shopify· active website
brand in the name “shopify”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand in page title, not in the name “namecheap”

Model opinion: looks like abuse (target: Shopify), confidence 80%. An opinion, not a finding.

Criticalshopify7dniv.comscore 61echoes shopify· active website
brand in the name “shopify”brand plus digits “shopify7dniv”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “shopify”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticaltiktokpad.lolscore 61echoes tiktok· active website
brand in the name “tiktok”TLD with a high abuse rate “lol”brand name at a retail registrar “Key-Systems, LLC”brand name and brand-styled page “tiktok”

Model opinion: looks like a scam (target: TikTok), confidence 80%. An opinion, not a finding.

Criticalechri.onlinescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalfileusllc.comscore 60· active website
page impersonates a brand “IRS”brand in page title, not in the name “stripe”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticalhydbeauty.lolscore 60· active website
TLD with a high abuse rate “lol”page pushes urgent payment “Risk Free”brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalorbio.capitalscore 60· active website
page impersonates a brand “Coinbase”brand in page title, not in the name “uniswap”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticalrivana.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalsafekey.livescore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: FedEx), confidence 90%. An opinion, not a finding.

Criticalwithheldcollective.orgscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highslotonlineshopee.comscore 59echoes shopee· active website
brand in the name “shopee”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “shopee”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Highvanguardapple.comscore 59echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”brand name and brand-styled page “apple”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Highwalmartnearme.orgscore 59echoes walmart· active website
brand in the name “walmart”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand name and brand-styled page “walmart”

Model opinion: looks like abuse (target: Walmart), confidence 72%. An opinion, not a finding.

Highen-telegram.sbsscore 58echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: looks like abuse (target: Telegram), confidence 82%. An opinion, not a finding.

Highnaisicloud.homesscore 58echoes icloud· active website
brand in the name “icloud”TLD with a high abuse rate “homes”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Highalipayjjka.comscore 56echoes alipay· active website
brand in the name “alipay”brand name at a retail registrar “Realtime Register B.V.”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 77%. An opinion, not a finding.

Highionosphereai.comscore 56echoes ionos· active website
brand in the name “ionos”brand name at a retail registrar “Squarespace Domains LLC”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Highpaperly.livescore 56· active website
page impersonates a brand “Binance”page pushes urgent payment “risk-free”brand in page title, not in the name “binance”

Model opinion: looks benign, confidence 77%. An opinion, not a finding.

High05-icloud.comscore 55echoes icloud
brand in the name “icloud”brand plus digits “05-icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more

Model opinion: suspicious (target: icloud), confidence 67%. An opinion, not a finding.

High3vrih5w.cyouscore 55echoes evri· no DNS
brand spelled with digits “3vrih5w→evri”brand plus digits “3vrih5w”TLD with a high abuse rate “cyou”brand name at a retail registrar “Todaynic.com, Inc.”

Model opinion: suspicious, confidence 65%. An opinion, not a finding.

High78win01-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win01-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

High78win02-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win02-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

High78win03-mobile.comscore 55echoes tmobile· no DNS
one-letter brand typo “mobile≈tmobile”brand plus digits “78win03-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

High78win06-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win06-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more

Model opinion: suspicious (target: tmobile), confidence 40%. An opinion, not a finding.

High78win08-mobile.comscore 55echoes tmobile· no DNS
one-letter brand typo “mobile≈tmobile”brand plus digits “78win08-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

High78win1-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win1-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
High78win2-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win2-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
High78win3-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win3-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
High78win5-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win5-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
High78win6-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win6-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
High78win8-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win8-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
High78win9-mobile.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “78win9-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more

Same data as JSON: /api/zone/risk?day=2026-10-05&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.