Flagged newborn domains, Tuesday, October 13, 2026
87 names at tier low or above in .net, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
brand in the name “coinbase”lure words (login, verify, secure…) “security”
brand in the name “whatsapp”brand plus digits “whatsapp8”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
one-letter brand typo “worday≈workday”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “682 identical pages”
Model opinion: suspicious (target: Workday), confidence 55%. An opinion, not a finding.
brand in the name “tmobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “icloud”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “roblox”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
page asks for credentials “sign in to your account”login form “has_form+login words”
Model opinion: suspicious, confidence 72%. An opinion, not a finding.
brand in the name “bbva”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
brand in the name “xbox”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “finance≈binance”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
one-letter brand typo “finance≈binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Global Domain Group LLC”
lure words (login, verify, secure…) “account,service,services”page impersonates a brand “IRS”
brand in the name “amazon”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “icloud”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “fidelity”brand name at a retail registrar “DropCatch.com 858 LLC”
brand in the name “tmobile”brand name at a retail registrar “OVH sas”
brand in the name “tiktok”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “gmail”brand name at a retail registrar “Internet Domain Service BS Corp”
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “INWX GmbH”
one-letter brand typo “finance≈binance”brand name at a retail registrar “Squarespace Domains LLC”
one-letter brand typo “zetflix≈netflix”brand name at a retail registrar “DropCatch.com 459 LLC”
lure words (login, verify, secure…) “password,passwords,support”free DNS provider “dnsowl.com”
punycode name “클래식클래식 scripts=HANGUL”random-looking name “H=3.79”
punycode name “เสาเข็มไมโครไพล์ scripts=THAI”very long name “29”
brand in page title, not in the name “nationwide”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “shopify”
brand in page title, not in the name “whatsapp”
brand in page title, not in the name “cloudflare”
punycode name “공식-홈페이지 scripts=HANGUL”
punycode name “跨境通 scripts=CJK”
punycode name “หวยลูกหมู scripts=THAI”
punycode name “ראשחשמל scripts=HEBREW”
punycode name “로또볼 scripts=HANGUL”
punycode name “슈카주소 scripts=HANGUL”
punycode name “资源 scripts=CJK”
punycode name “bienentourés scripts=LATIN”
punycode name “calculadoradesueño scripts=LATIN”
punycode name “苍茗诀 scripts=CJK”
punycode name “兴达钢帘线 scripts=CJK”
punycode name “eüretici scripts=LATIN”
punycode name “人人可课 scripts=CJK”
punycode name “슈카 scripts=HANGUL”
punycode name “餃子 scripts=CJK”
punycode name “koshaè scripts=LATIN”
punycode name “único scripts=LATIN”
punycode name “클레식클레식 scripts=HANGUL”
punycode name “présencia scripts=LATIN”
punycode name “schöne scripts=LATIN”
Same data as JSON: /api/zone/risk?day=2026-10-13&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.