Flagged newborn domains, Monday, October 5, 2026

10 names at tier medium or above in .blog, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highmobile-site-76.blogscore 55echoes tmobile· redirects elsewhere
one-letter brand typo “mobile≈tmobile”brand plus digits “mobile-site-76”brand name at a retail registrar “Automattic Inc.”form on a brand-styled page “has_form”+1 more

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Mediumbluebay.blogscore 38echoes ebay· no DNS
brand in the name “ebay”brand name at a retail registrar “XServer, Inc.”
Mediumdesignteam.blogscore 38· active website
brand in page title, not in the name “telegram”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Mediumeverywhereisnorth.blogscore 38· redirects elsewhere
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Mediumgerardogarza.blogscore 38· active website
brand in page title, not in the name “telegram”form on a brand-styled page “has_form”
Mediummetalclin.blogscore 38· active website
brand in page title, not in the name “telegram”form on a brand-styled page “has_form”
Mediumpdfs.blogscore 38· active website
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Mediumsecretplace.blogscore 38· active website
brand in page title, not in the name “telegram”form on a brand-styled page “has_form”
Mediumzacero.blogscore 38· active website
brand in page title, not in the name “telegram”form on a brand-styled page “has_form”
Mediumcinex.blogscore 36· active website
page impersonates a brand “Netflix”login form “has_form+login words”

Same data as JSON: /api/zone/risk?day=2026-10-05&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.