one-letter brand typo “looking≈booking”many hyphens “5”very long name “35”brand name behind Cloudflare “cloudflare.com”
page asks for credentials “login to your account”login form “has_form+login words”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “revolut”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”
brand in the name “robinhood”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”
brand in the name “roblox”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
Model opinion: looks like abuse (target: Roblox), confidence 77%. An opinion, not a finding.
brand in the name “roblox”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
Model opinion: looks like abuse (target: Roblox), confidence 80%. An opinion, not a finding.
brand in the name “sharepoint”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”
many hyphens “3”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
lure words (login, verify, secure…) “track”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 81%. An opinion, not a finding.
brand in the name “starlink”brand plus digits “starlink4dkota”brand name behind Cloudflare “cloudflare.com”
Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.
brand in the name “starlink”brand plus digits “starlink4dlink”brand name behind Cloudflare “cloudflare.com”
brand in the name “tiktok”TLD with a high abuse rate “buzz”brand name behind Cloudflare “cloudflare.com”
brand in the name “binance”brand plus digits “t837322binance”brand name behind Cloudflare “cloudflare.com”
brand in the name “telegram”brand plus digits “taya365telegram”brand name behind Cloudflare “cloudflare.com”
page asks for credentials “login to your account”login form “has_form+login words”
Model opinion: looks benign, confidence 83%. An opinion, not a finding.
brand in the name “telegram”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “track”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 69%. An opinion, not a finding.
lure words (login, verify, secure…) “track”brand in page title, not in the name “apple”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
brand in the name “usaa”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”
brand in the name “usaa”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”
brand in the name “usaa”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”
brand in the name “usaa”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “service”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 47%. An opinion, not a finding.
brand in the name “vanguard”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “mobile≈tmobile”many hyphens “5”very long name “33”brand name behind Cloudflare “cloudflare.com”
many hyphens “3”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 76%. An opinion, not a finding.
brand in the name “whatsapp”brand plus digits “w1web-whatsapp”brand name behind Cloudflare “cloudflare.com”
brand in the name “whatsapp”brand plus digits “w2web-whatsapp”brand name behind Cloudflare “cloudflare.com”
brand in the name “xbox”brand plus digits “xboxgaoqingshipinxian8”brand name behind Cloudflare “cloudflare.com”
Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.
brand in the name “onedrive”brand plus digits “11013fieldstonedrive”random-looking name “H=3.65”
brand spelled with digits “goog1eworkspace→google”brand plus digits “goog1eworkspace”
one-letter brand typo “5mobile≈tmobile”brand plus digits “5mobile-msislot”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “6mobile≈tmobile”brand plus digits “6mobile-msislot”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “8mobile≈tmobile”brand plus digits “8mobile-msislot”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “9mobile≈tmobile”brand plus digits “9mobile-msislot”brand name behind Cloudflare “cloudflare.com”
page impersonates a brand “Coinbase”brand in page title, not in the name “robinhood”
Model opinion: suspicious, confidence 54%. An opinion, not a finding.
page impersonates a brand “Binance”brand in page title, not in the name “binance”
Model opinion: looks benign, confidence 50%. An opinion, not a finding.
one-letter brand typo “finance≈binance”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
Model opinion: looks like phishing (target: Pendle (Boros)), confidence 80%. An opinion, not a finding.
very long name “34”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 41%. An opinion, not a finding.
page impersonates a brand “Binance”brand in page title, not in the name “binance”
Model opinion: suspicious, confidence 54%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”
Model opinion: looks benign, confidence 78%. An opinion, not a finding.
one-letter brand typo “cosco≈costco”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”
page impersonates a brand “Microsoft 365”brand in page title, not in the name “whatsapp”
Model opinion: looks benign, confidence 48%. An opinion, not a finding.
lure words (login, verify, secure…) “reward,rewards”TLD with a high abuse rate “xyz”page impersonates a brand “PayPal”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
page impersonates a brand “USPS”brand in page title, not in the name “usps”
Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.
page impersonates a brand “Coinbase”brand in page title, not in the name “robinhood”
Model opinion: suspicious, confidence 46%. An opinion, not a finding.
one-letter brand typo “googlie≈google”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”