Flagged newborn domains, Saturday, October 10, 2026

9,107 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Low73klogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low7777wlogin.cfdscore 14· not probed yet
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low7777wlogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low777winlogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low77rplogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low77rtlogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low7meterlogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low8055login.icuscore 14· not probed yet
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low8180login.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low888rlogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low888rlogin.icuscore 14· not probed yet
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low88idlogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low898alogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low8g8glogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low8idlogin.icuscore 14· not probed yet
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low8iilogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low8qrlogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low8sviplogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low8zklogin.cfdscore 14· not probed yet
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low999llogin.cfdscore 14· not probed yet
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low99rplogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low99sllogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Low99sllogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low9n9nlogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low9sllogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Low9to5.betscore 14· active website
page pushes urgent payment “Claim your bonus”
Low9zklogin.cfdscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Lowa200mlogin.icuscore 14· boilerplate page
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowabreward.xyzscore 14· boilerplate page
lure words (login, verify, secure…) “reward”TLD with a high abuse rate “xyz”
Lowaccaccess.cfdscore 14· active website
lure words (login, verify, secure…) “access”TLD with a high abuse rate “cfd”
Lowaccess-ekinet.helpscore 14· no web server
lure words (login, verify, secure…) “access”free DNS provider “dnsowl.com”
Lowaccessdocumentcenter.topscore 14· redirects elsewhere
lure words (login, verify, secure…) “access”TLD with a high abuse rate “top”
Lowaccessusepaid.xyzscore 14· empty page
lure words (login, verify, secure…) “access”TLD with a high abuse rate “xyz”
Lowaccountcore.boatsscore 14· not probed yet
lure words (login, verify, secure…) “account”TLD with a high abuse rate “boats”
Lowaccurarevolution.livescore 14echoes revolut· no DNS
brand in the name “revolut”
Lowactivelife.worldscore 14· active website
page pushes urgent payment “RISK-FREE”
Lowads-tracker.clickscore 14· not probed yet
lure words (login, verify, secure…) “track”TLD with a high abuse rate “click”
Lowadsjr868.icuscore 14· active website
TLD with a high abuse rate “icu”form submits over plain HTTP “http://adsjr868.icu/yz.php”
Lowadvanceamazonbusinessagency.comscore 14echoes amazon
brand in the name “amazon”
Lowadvanceamazoninsightshub.comscore 14echoes amazon
brand in the name “amazon”
Lowadvanceamazonretailadvisor.comscore 14echoes amazon· no DNS
brand in the name “amazon”
Lowadvanceamazonretailagency.comscore 14echoes amazon· no DNS
brand in the name “amazon”
Lowadvanceamazonretailinsights.comscore 14echoes amazon
brand in the name “amazon”
Lowadvanceamazonretailleaders.comscore 14echoes amazon
brand in the name “amazon”
Lowafaflogin.cfdscore 14· not probed yet
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cfd”
Lowafrika-ggtv-2-1.topscore 14· active website
many hyphens “3”TLD with a high abuse rate “top”
Lowafrika-ggtv-3-1.topscore 14· not probed yet
many hyphens “3”TLD with a high abuse rate “top”
Lowagaziofficial.xyzscore 14· not probed yet
lure words (login, verify, secure…) “official”TLD with a high abuse rate “xyz”
Lowagencyvetc.clickscore 14· active website
TLD with a high abuse rate “click”form submits over plain HTTP “https://agencyvetc.click/”
Lowagendapx.onlinescore 14· active website
login form “has_form+login words”

Same data as JSON: /api/zone/risk?day=2026-10-10&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.