Flagged newborn domains, Thursday, October 15, 2026
2,613 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “福州奶娃国际大学 scripts=CJK”very long name “28”random-looking name “H=4.36”TLD with a high abuse rate “top”
punycode name “浙江奶龙外国语大学 scripts=CJK”very long name “32”random-looking name “H=3.99”TLD with a high abuse rate “icu”
punycode name “奶龙职业技术大学 scripts=CJK”very long name “29”random-looking name “H=4.16”TLD with a high abuse rate “icu”
punycode name “宁波城市职业奶蛙学院 scripts=CJK”very long name “36”random-looking name “H=4.48”TLD with a high abuse rate “icu”
punycode name “济南奶龙职业技术学院 scripts=CJK”very long name “36”random-looking name “H=4.34”TLD with a high abuse rate “icu”
punycode name “广东奶龙职业学院 scripts=CJK”very long name “29”random-looking name “H=4.46”TLD with a high abuse rate “icu”
lure words (login, verify, secure…) “service,services”page impersonates a brand “IRS”
lure words (login, verify, secure…) “claim,claims”TLD with a high abuse rate “cfd”login form “has_form+login words”
lure words (login, verify, secure…) “claim,claims”TLD with a high abuse rate “cfd”login form “has_form+login words”
lure words (login, verify, secure…) “claim,claims”TLD with a high abuse rate “cfd”login form “has_form+login words”
lure words (login, verify, secure…) “claim,claims”TLD with a high abuse rate “cfd”login form “has_form+login words”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”
page pushes urgent payment “risk-free”brand in page title, not in the name “google”
lure words (login, verify, secure…) “limited”TLD with a high abuse rate “click”brand in page title, not in the name “google”
lure words (login, verify, secure…) “login,secure,verify”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
one-letter brand typo “starlnk≈starlink”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “track”TLD with a high abuse rate “xyz”brand in page title, not in the name “outlook”
ambiguous brand word “booking”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”brand name and brand-styled page “booking”
lure words (login, verify, secure…) “member,members”brand in page title, not in the name “nationwide”
very long name “28”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “facebook”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “namecheap”
very long name “41”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
punycode name “冰购城 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--37qy2md16c.top/”
punycode name “奶龙医学院 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--ekrv8lttbz47i6vj.top/”
lure words (login, verify, secure…) “payment”nameserver domain born the same day “iinkhub.com”
lure words (login, verify, secure…) “payment”nameserver domain born the same day “iinkhub.com”
lure words (login, verify, secure…) “payment”nameserver domain born the same day “iinkhub.com”
lure words (login, verify, secure…) “payment”nameserver domain born the same day “iinkhub.com”
lure words (login, verify, secure…) “payment”nameserver domain born the same day “iinkhub.com”
lure words (login, verify, secure…) “payment”nameserver domain born the same day “iinkhub.com”
punycode name “南京奶龙大学 scripts=CJK”random-looking name “H=3.62”TLD with a high abuse rate “icu”
punycode name “桐子律师事务所 scripts=CJK”random-looking name “H=4.26”TLD with a high abuse rate “icu”
punycode name “山东双一流大学 scripts=CJK”random-looking name “H=4.00”TLD with a high abuse rate “top”
punycode name “九一奶蛙大学 scripts=CJK”random-looking name “H=3.92”TLD with a high abuse rate “icu”
punycode name “山東雙一流大學 scripts=CJK”random-looking name “H=4.08”TLD with a high abuse rate “top”
punycode name “河南奶娃大学 scripts=CJK”random-looking name “H=3.93”TLD with a high abuse rate “work”
punycode name “南昌奶龙大学 scripts=CJK”random-looking name “H=4.12”TLD with a high abuse rate “icu”
punycode name “河南奶龙大学 scripts=CJK”random-looking name “H=4.01”TLD with a high abuse rate “work”
punycode name “奶蛙联合大学 scripts=CJK”random-looking name “H=3.92”TLD with a high abuse rate “work”
punycode name “域名购买 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “河北奶龙学院 scripts=CJK”random-looking name “H=4.00”TLD with a high abuse rate “icu”
punycode name “東北奶龍大學 scripts=CJK”random-looking name “H=3.78”TLD with a high abuse rate “top”
punycode name “西北奶龙大学 scripts=CJK”random-looking name “H=4.11”TLD with a high abuse rate “icu”
punycode name “西北奶蛙大学 scripts=CJK”random-looking name “H=3.82”TLD with a high abuse rate “icu”
punycode name “西北大奶蛙大学 scripts=CJK”random-looking name “H=4.00”TLD with a high abuse rate “fun”
punycode name “大湾区奶龙大学 scripts=CJK”random-looking name “H=4.17”TLD with a high abuse rate “icu”
punycode name “大湾区奶龙大学 scripts=CJK”random-looking name “H=4.17”TLD with a high abuse rate “top”
punycode name “行業五百強企業 scripts=CJK”random-looking name “H=4.17”TLD with a high abuse rate “top”
Same data as JSON: /api/zone/risk?day=2026-10-15&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.