Flagged newborn domains, Thursday, October 8, 2026

26 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalfilepackage-documentm365778-okta.infoscore 92echoes okta· active website
brand in the name “okta”lure words (login, verify, secure…) “package”very long name “32”brand plus digits “filepackage-documentm365778-okta”+2 more

Model opinion: looks like abuse (target: Okta), confidence 78%. An opinion, not a finding.

Criticalxinweicloud.sbsscore 86echoes icloud· active website
brand in the name “icloud”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Netflix”+1 more

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalintesatradeai.sitescore 76echoes intesa· active website
brand in the name “intesa”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Coinbase”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Intesa Sanpaolo), confidence 88%. An opinion, not a finding.

Criticaltrezr.funscore 74echoes trezor· active website
one-letter brand typo “trezr≈trezor”TLD with a high abuse rate “fun”brand in page title, not in the name “ledger”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalnetflix-it.orgscore 73echoes netflix· active website
brand in the name “netflix”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Netflix”brand name and brand-styled page “netflix”

Model opinion: looks like abuse (target: Netflix), confidence 86%. An opinion, not a finding.

Criticalamazonapiwebservices.cloudscore 68echoes amazon· active website
brand in the name “amazon”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Amazon Web Services), confidence 93%. An opinion, not a finding.

Criticalmovieindo.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalmp4start.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalvanguardfront.onlinescore 67echoes vanguard· active website
brand in the name “vanguard”page impersonates a brand “PAYPAL”brand name and brand-styled page “vanguard”

Model opinion: looks benign, confidence 77%. An opinion, not a finding.

Criticalparcelradar.appscore 66· active website
lure words (login, verify, secure…) “parcel”page impersonates a brand “DHL”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalkabukiroblox.wikiscore 65echoes roblox· active website
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 77%. An opinion, not a finding.

Criticalintesatradeai.clickscore 62echoes intesa· active website
brand in the name “intesa”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 88%. An opinion, not a finding.

Criticalbusytwin.comscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “outlook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalcinemaisplay.spacescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalgetpicture.netscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalhashcrew.livescore 60· active website
page impersonates a brand “Coinbase”brand in page title, not in the name “phantom”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalhdmovie2a.blogscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 93%. An opinion, not a finding.

Criticalmacqbot.proscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

Criticalmergemylibrary.comscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalonaycisms.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalopenbookproject.orgscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 74%. An opinion, not a finding.

Criticalrafaflix.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalsafedocument.orgscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Microsoft), confidence 96%. An opinion, not a finding.

Criticalteamox.appscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalvanahex.latscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalvirex-shope.comscore 60echoes shopee· active website
one-letter brand typo “shope≈shopee”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-10-08&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.