brand in the name “coinbase”brand plus digits “205890coinbase”random-looking name “H=3.66”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: suspicious (target: coinbase), confidence 64%. An opinion, not a finding.
brand in the name “coinbase”brand plus digits “256988coinbase”random-looking name “H=3.66”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Model opinion: suspicious (target: coinbase), confidence 63%. An opinion, not a finding.
brand in the name “robinhood”brand plus digits “256988robinhood”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Model opinion: suspicious (target: robinhood), confidence 68%. An opinion, not a finding.
brand in the name “coinbase”brand plus digits “327825coinbase”random-looking name “H=3.66”brand name behind Cloudflare “cloudflare.com”+2 more
Model opinion: suspicious (target: coinbase), confidence 69%. An opinion, not a finding.
brand in the name “google”brand plus digits “592361google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Model opinion: suspicious (target: google), confidence 69%. An opinion, not a finding.
brand in the name “cloudflare”lure words (login, verify, secure…) “access”brand name behind Cloudflare “cloudflare.com”
Model opinion: suspicious (target: cloudflare), confidence 83%. An opinion, not a finding.
brand in the name “google”lure words (login, verify, secure…) “account”many hyphens “3”very long name “35”+3 more
Model opinion: looks like phishing (target: Google), confidence 97%. An opinion, not a finding.
brand in the name “google”lure words (login, verify, secure…) “account”many hyphens “3”very long name “35”+2 more
Model opinion: suspicious (target: google), confidence 65%. An opinion, not a finding.
brand in the name “shopify”lure words (login, verify, secure…) “account”
Model opinion: suspicious (target: shopify), confidence 77%. An opinion, not a finding.
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “account”identical page on many newborns “122 identical pages”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
Highai-pay.vipscore 55echoes alipay· boilerplate page one-letter brand typo “aipay≈alipay”lure words (login, verify, secure…) “pay”brand name on a rarely-seen nameserver “cscdns.net”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
brand spelled with digits “amaz0n-securelogin→amazon”lure words (login, verify, secure…) “login,secure”brand plus digits “amaz0n-securelogin”brand name at a retail registrar “GoDaddy.com, LLC”
Model opinion: suspicious (target: amazon), confidence 56%. An opinion, not a finding.
brand in the name “amazon”lure words (login, verify, secure…) “track”
Model opinion: suspicious (target: amazon), confidence 83%. An opinion, not a finding.
brand in the name “amazon”brand plus digits “amazon789thai”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: suspicious (target: amazon), confidence 57%. An opinion, not a finding.
brand in the name “office365”lure words (login, verify, secure…) “auth”brand plus digits “auth-office365-meet”brand name behind Cloudflare “cloudflare.com”
Model opinion: suspicious (target: office365), confidence 77%. An opinion, not a finding.
brand spelled with digits “bagus44→usaa”brand plus digits “bagus44”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: suspicious (target: USAA), confidence 60%. An opinion, not a finding.
brand in the name “barclays”lure words (login, verify, secure…) “portal”brand name on a rarely-seen nameserver “nsnamedns.net”
Model opinion: suspicious (target: barclays), confidence 75%. An opinion, not a finding.
brand in the name “barclays”lure words (login, verify, secure…) “payment”
brand in the name “bestbuy”brand plus digits “bestbuy24”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
brand in the name “binance”brand plus digits “binance10”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “binance”brand plus digits “binanceexchangep2p”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “binance”form on a brand-styled page “has_form”identical page on many newborns “1411 identical pages”
Model opinion: looks like abuse (target: Binance), confidence 80%. An opinion, not a finding.
brand in the name “binance”brand plus digits “binancep2pexchange”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 77%. An opinion, not a finding.
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 74%. An opinion, not a finding.
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 74%. An opinion, not a finding.
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 70%. An opinion, not a finding.
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 72%. An opinion, not a finding.
brand in the name “whatsapp”brand name at a retail registrar “GKG.Net, Inc.”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 70%. An opinion, not a finding.
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 77%. An opinion, not a finding.
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 74%. An opinion, not a finding.
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”
Model opinion: looks like abuse (target: WhatsApp), confidence 75%. An opinion, not a finding.
brand in the name “gmail”lure words (login, verify, secure…) “account,accounts”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Tucows Domains Inc.”
brand in the name “tiktok”lure words (login, verify, secure…) “account,accounts”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Tucows Domains Inc.”
brand in the name “bybit”lure words (login, verify, secure…) “payment,payments”brand name behind Cloudflare “cloudflare.com”
brand in the name “revolut”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand spelled with digits “ch4t9pt→chatgpt”brand plus digits “ch4t9pt”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: looks like abuse (target: OpenAI (ChatGPT)), confidence 70%. An opinion, not a finding.
brand in the name “whatsapp”TLD with a high abuse rate “win”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
Model opinion: looks like abuse (target: WhatsApp), confidence 70%. An opinion, not a finding.
brand in the name “cibc”lure words (login, verify, secure…) “access,security”identical page on many newborns “47 identical pages”
Model opinion: looks like abuse (target: CIBC), confidence 80%. An opinion, not a finding.
brand in the name “cibc”lure words (login, verify, secure…) “alert,alerts”
brand spelled with digits “cleaningit4u→itau”brand plus digits “cleaningit4u”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “gov,invoice”many hyphens “4”
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “cloudflare”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Gname.com Pte. Ltd.”+1 more
brand in the name “roblox”lure words (login, verify, secure…) “verify”TLD with a high abuse rate “sbs”brand name at a retail registrar “Porkbun LLC”+1 more
brand in the name “coinbase”lure words (login, verify, secure…) “support”
brand in the name “coinbase”lure words (login, verify, secure…) “update”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Coinbase), confidence 77%. An opinion, not a finding.
brand in the name “comcast”lure words (login, verify, secure…) “service,services”
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “costcowholesale-rewards8834”brand name at a retail registrar “Tucows Domains Inc.”