Flagged newborn domains, Thursday, October 8, 2026

2,916 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highsupportcoinbase-ie.helpscore 55echoes coinbase· no DNS
brand in the name “coinbase”lure words (login, verify, secure…) “support”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Highsupportcoinbase.infoscore 55echoes coinbase· no DNS
brand in the name “coinbase”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”
Hightelegramchatx.sbsscore 55echoes telegram· robots.txt denied
brand in the name “telegram”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Hightiktok-1688.comscore 55echoes tiktok· robots.txt denied
brand in the name “tiktok”brand plus digits “tiktok-1688”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Hightrisakti88-tiktok.orgscore 55echoes tiktok· blocked the probe
brand in the name “tiktok”brand plus digits “trisakti88-tiktok”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
Hightrust-wallets-cards-club.clickscore 55echoes trustwallet· not probed yet
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”many hyphens “3”TLD with a high abuse rate “click”+1 more
Hightrustwallet-fr.comscore 55echoes trustwallet
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”
Highud-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”brand name redirects elsewhere “bing.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 80%. An opinion, not a finding.

Highuf-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”brand name redirects elsewhere “bing.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 77%. An opinion, not a finding.

Highus444.netscore 55echoes usaa
brand spelled with digits “us444→usaa”brand plus digits “us444”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “DEVEXPANSE LTD d/b/a Regery.com”+1 more
Highus444.orgscore 55echoes usaa· not probed yet
brand spelled with digits “us444→usaa”brand plus digits “us444”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “usaa”lure words (login, verify, secure…) “customer,customers,service”very long name “34”
Highusaallbirdss.shopscore 55echoes usaa· blocked the probe
brand in the name “usaa”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
Highusadocxbox.cfdscore 55echoes xbox· not probed yet
brand in the name “xbox”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highusadocxbox.sbsscore 55echoes xbox· not probed yet
brand in the name “xbox”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highuserlogin2fabankofamerica.comscore 55echoes bankofamerica
brand in the name “bankofamerica”lure words (login, verify, secure…) “login”brand plus digits “userlogin2fabankofamerica”brand name on a rarely-seen nameserver “bb-online.biz”
Highuspofficialgmail.comscore 55echoes gmail
brand in the name “gmail”lure words (login, verify, secure…) “official”
Highusps-us.blogscore 55echoes usps· redirects elsewhere
brand in the name “usps”brand name at a retail registrar “Porkbun, LLC”brand name at a watch-list registrar “Porkbun, LLC”brand in page title, not in the name “google”+2 more

Model opinion: looks like abuse (target: USPS), confidence 80%. An opinion, not a finding.

Highvanguardelectricservices.comscore 55echoes vanguard
brand in the name “vanguard”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”
Highverify-i0nos.infoscore 55echoes ionos· no DNS
brand spelled with digits “verify-i0nos→ionos”lure words (login, verify, secure…) “verify”brand plus digits “verify-i0nos”brand name on a rarely-seen nameserver “lytehosting.com”
Highverify-lcloud.shopscore 55echoes icloud· robots.txt denied
one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”
Highvote-spotify.xyzscore 55echoes spotify· no DNS
brand in the name “spotify”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Highweb3google.topscore 55echoes google· empty page
brand in the name “google”brand plus digits “web3google”TLD with a high abuse rate “top”brand name and brand-styled page “google”

Model opinion: looks like abuse (target: Google), confidence 70%. An opinion, not a finding.

Highwhatsapptv.onlinescore 55echoes whatsapp· registrar placeholder
brand in the name “whatsapp”brand in page title, not in the name “hostinger”identical page on many newborns “95 identical pages”

Model opinion: looks like abuse (target: WhatsApp), confidence 60%. An opinion, not a finding.

Highwhatsapptv360.onlinescore 55echoes whatsapp· registrar placeholder
brand in the name “whatsapp”brand plus digits “whatsapptv360”brand in page title, not in the name “hostinger”identical page on many newborns “95 identical pages”

Model opinion: looks like abuse (target: WhatsApp), confidence 60%. An opinion, not a finding.

Highzachdronellcpetrecoverygmail.llcscore 55echoes gmail· redirects elsewhere
brand in the name “gmail”lure words (login, verify, secure…) “recover,recovery”very long name “28”brand name redirects elsewhere “glideraircraftdrones.online”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Highaccountsgmail24.comscore 54echoes gmail
brand in the name “gmail”lure words (login, verify, secure…) “account,accounts”brand plus digits “accountsgmail24”
Highaccountsgmailnow.comscore 54echoes gmail
brand in the name “gmail”lure words (login, verify, secure…) “account,accounts”brand name at a retail registrar “Tucows Domains Inc.”
Highamazvon.comscore 54echoes amazon· blocked the probe
one-letter brand typo “amazvon≈amazon”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
Highbestcosmeticsdealsonamazon.appscore 54echoes amazon· registrar placeholder
brand in the name “amazon”brand name at a retail registrar “Namecheap Inc.”brand name at a watch-list registrar “Namecheap Inc.”identical page on many newborns “4025 identical pages”
Highbestcosmeticsdealsonamazon.onlinescore 54echoes amazon· registrar placeholder
brand in the name “amazon”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4025 identical pages”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highbramblebay.worldscore 54echoes ebay· registrar placeholder
brand in the name “ebay”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4025 identical pages”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highcaramel-jubileebay.shopscore 54echoes ebay· active website
brand in the name “ebay”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highcockpit-finance.comscore 54echoes binance· active website
one-letter brand typo “finance≈binance”brand name at a retail registrar “Name.com, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Highddmti.topscore 54· redirects elsewhere
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highfklero-cloud.xyzscore 54echoes icloud· active website
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highhelp-natwestinternational.comscore 54echoes natwest
brand in the name “natwest”lure words (login, verify, secure…) “help”brand name on a rarely-seen nameserver “nsnamedns.net”brand name at a retail registrar “OwnRegistrar, Inc.”
Highhelpcentershopify.onlinescore 54echoes shopify· registrar placeholder
brand in the name “shopify”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4025 identical pages”
Highhulubet.casinoscore 54echoes hulu· registrar placeholder
brand in the name “hulu”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4025 identical pages”

Model opinion: suspicious, confidence 50%. An opinion, not a finding.

Highlogin-microsofl.comscore 54echoes microsoft
one-letter brand typo “microsofl≈microsoft”lure words (login, verify, secure…) “login”
Highloginmicrosoft0nline.comscore 54echoes microsoft
brand in the name “microsoft”lure words (login, verify, secure…) “login”brand plus digits “loginmicrosoft0nline”brand name behind Cloudflare “cloudflare.com”
Highmycostcorewards2218.comscore 54echoes costco
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards2218”
Highplaycrestmobile.comscore 54echoes tmobile· registrar placeholder
brand in the name “tmobile”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “740 identical pages”
Highportaliteitaulgob.workscore 54echoes itau· not probed yet
brand in the name “itau”lure words (login, verify, secure…) “portal”TLD with a high abuse rate “work”brand name behind Cloudflare “cloudflare.com”
Highschwabing-freimann.infoscore 54echoes schwab· boilerplate page
brand in the name “schwab”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”identical page on many newborns “31 identical pages”

Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.

Highschwabing-west.infoscore 54echoes schwab· boilerplate page
brand in the name “schwab”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”identical page on many newborns “31 identical pages”

Model opinion: unreachable when judged, confidence 72%. An opinion, not a finding.

Highservicebayos.comscore 54echoes ebay
brand in the name “ebay”lure words (login, verify, secure…) “service”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Highsterling-point-lordserial.topscore 54echoes starling· active website
one-letter brand typo “sterling≈starling”TLD with a high abuse rate “top”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Hightiktokepisode.comscore 54echoes tiktok· registrar placeholder
brand in the name “tiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “740 identical pages”

Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.

Highamazon-guardian.appscore 53echoes amazon· other
brand in the name “amazon”brand name at a retail registrar “Tucows Domains Inc”brand name and brand-styled page “amazon”

Model opinion: looks like abuse (target: Amazon), confidence 60%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-10-08&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.