Flagged newborn domains, Friday, October 16, 2026

1,032 names at tier high or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

High101google.marketingscore 55echoes google· boilerplate page
brand in the name “google”brand plus digits “101google”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “3747 identical pages”

Model opinion: looks like abuse (target: Google), confidence 58%. An opinion, not a finding.

High115102-robinhood.comscore 55echoes robinhood
brand in the name “robinhood”brand plus digits “115102-robinhood”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: suspicious (target: robinhood), confidence 72%. An opinion, not a finding.

High1z0om.topscore 55echoes zoom· no DNS
brand spelled with digits “1z0om→zoom”brand plus digits “1z0om”TLD with a high abuse rate “top”brand name at a retail registrar “NameMart Pte. Ltd.”

Model opinion: looks like abuse (target: Zoom), confidence 60%. An opinion, not a finding.

High489284coinbase.comscore 55echoes coinbase
brand in the name “coinbase”brand plus digits “489284coinbase”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: suspicious (target: coinbase), confidence 65%. An opinion, not a finding.

High632001coinbase.comscore 55echoes coinbase
brand in the name “coinbase”brand plus digits “632001coinbase”random-looking name “H=3.66”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: suspicious (target: coinbase), confidence 62%. An opinion, not a finding.

High743925coinbase.comscore 55echoes coinbase
brand in the name “coinbase”brand plus digits “743925coinbase”random-looking name “H=3.81”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: suspicious (target: coinbase), confidence 69%. An opinion, not a finding.

High88va8.topscore 55echoes bbva· no DNS
brand spelled with digits “88va8→bbva”brand plus digits “88va8”TLD with a high abuse rate “top”brand name at a retail registrar “NameMart Pte. Ltd.”

Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.

Highaccounting-cloud.workscore 55echoes icloud· no DNS
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “account”TLD with a high abuse rate “work”

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Highaccountreviewrevolut.comscore 55echoes revolut
brand in the name “revolut”lure words (login, verify, secure…) “account”brand name on a rarely-seen nameserver “nsnamedns.net”

Model opinion: suspicious (target: revolut), confidence 86%. An opinion, not a finding.

Highaccounts-shopify-mystore.comscore 55echoes shopify
brand in the name “shopify”lure words (login, verify, secure…) “account,accounts”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: shopify), confidence 72%. An opinion, not a finding.

Highadobedocumentry.sbsscore 55echoes adobe· blocked the probe
brand in the name “adobe”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: suspicious (target: Adobe), confidence 65%. An opinion, not a finding.

Highadobeupdate.icuscore 55echoes adobe· not probed yet
brand in the name “adobe”lure words (login, verify, secure…) “update”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: adobe), confidence 75%. An opinion, not a finding.

Highadvanceamazonservices.comscore 55echoes amazon
brand in the name “amazon”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”

Model opinion: suspicious (target: amazon), confidence 74%. An opinion, not a finding.

Highairdropamazon.xyzscore 55echoes amazon· not probed yet
brand in the name “amazon”lure words (login, verify, secure…) “airdrop”TLD with a high abuse rate “xyz”
Highairdropstripe.xyzscore 55echoes stripe· not probed yet
brand in the name “stripe”lure words (login, verify, secure…) “airdrop”TLD with a high abuse rate “xyz”
Highalert-service-venmo.comscore 55echoes venmo
brand in the name “venmo”lure words (login, verify, secure…) “alert,alerts,service”
Highamazongaoqingshipin1.babyscore 55echoes amazon· not probed yet
brand in the name “amazon”brand plus digits “amazongaoqingshipin1”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highamazonpayment.xyzscore 55echoes amazon· not probed yet
brand in the name “amazon”lure words (login, verify, secure…) “payment”TLD with a high abuse rate “xyz”
Highamex-help.comscore 55echoes amex
brand in the name “amex”lure words (login, verify, secure…) “help”
Highapp-trustwallet.cfdscore 55echoes trustwallet· redirects elsewhere
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”TLD with a high abuse rate “cfd”

Model opinion: looks like abuse (target: Trust Wallet), confidence 85%. An opinion, not a finding.

Highauthenticator-rbcsecured.comscore 55echoes authenticator
brand in the name “authenticator”lure words (login, verify, secure…) “secure”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.S.”
Highbankofamericaclaimsinsurance.comscore 55echoes bankofamerica
brand in the name “bankofamerica”lure words (login, verify, secure…) “claim,claims”very long name “28”
Highbarclays-help.netscore 55echoes barclays
brand in the name “barclays”lure words (login, verify, secure…) “help”brand name on a rarely-seen nameserver “impreza.host”
Highbarclaysiportalsupportchat.comscore 55echoes barclays
brand in the name “barclays”lure words (login, verify, secure…) “portal,support”
Highbarclayspaymentreview.comscore 55echoes barclays
brand in the name “barclays”lure words (login, verify, secure…) “payment”brand name on a rarely-seen nameserver “nsnamedns.net”
Highbd45gmail.comscore 55echoes gmail
brand in the name “gmail”brand plus digits “bd45gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Highbestbuyratings.sitescore 55echoes bestbuy· suspended
brand in the name “bestbuy”form on a brand-styled page “has_form”brand name redirects elsewhere “expireddomains.com”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highbinance-signin.comscore 55echoes binance
brand in the name “binance”lure words (login, verify, secure…) “signin”brand name behind Cloudflare “cloudflare.com”
Highbinancesupport.appscore 55echoes binance· no DNS
brand in the name “binance”lure words (login, verify, secure…) “support”
Highblnance.orgscore 55echoes binance· registrar placeholder
one-letter brand typo “blnance≈binance”form on a brand-styled page “has_form”identical page on many newborns “1723 identical pages”

Model opinion: looks like abuse (target: Binance), confidence 80%. An opinion, not a finding.

Highbonos-livelo-itau-30horas.comscore 55echoes itau
brand in the name “itau”many hyphens “3”brand plus digits “bonos-livelo-itau-30horas”brand name behind Cloudflare “cloudflare.com”+1 more
Highbuy-linkedin-account.comscore 55echoes linkedin
brand in the name “linkedin”lure words (login, verify, secure…) “account”
Highchatwhatsapp.techscore 55echoes whatsapp· empty page
brand in the name “whatsapp”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand name and brand-styled page “whatsapp”

Model opinion: looks like abuse (target: WhatsApp), confidence 60%. An opinion, not a finding.

Highclaim-bybit.appscore 55echoes bybit· not probed yet
brand in the name “bybit”lure words (login, verify, secure…) “claim”brand name behind Cloudflare “cloudflare.com”
Highclaimscotiabank.comscore 55echoes scotiabank· no DNS
brand in the name “scotiabank”lure words (login, verify, secure…) “claim,claims”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.S.”
Highcloud-accounting.digitalscore 55echoes icloud· no DNS
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “account”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Highcloud-accounting.workscore 55echoes icloud· no DNS
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “account”TLD with a high abuse rate “work”
Highcm-gtg-cloudflare-sandbox.comscore 55echoes cloudflare
brand in the name “cloudflare”many hyphens “3”random-looking name “H=3.91”brand name behind Cloudflare “cloudflare.com”+1 more
Highcoloradostarlink.infoscore 55echoes starlink· suspended
brand in the name “starlink”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Starlink), confidence 55%. An opinion, not a finding.

Highconfirm-booking.clickscore 55echoes booking· no DNS
brand in the name “booking”lure words (login, verify, secure…) “confirm”TLD with a high abuse rate “click”
Highcounterintuit.comscore 55echoes intuit· redirects elsewhere
brand in the name “intuit”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”+1 more

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Highcr777-cloud.comscore 55echoes icloud
one-letter brand typo “cloud≈icloud”brand plus digits “cr777-cloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Highdocs-google.onescore 55echoes google· blocked the probe
brand in the name “google”brand name at a retail registrar “Porkbun”brand name at a watch-list registrar “Porkbun”brand in page title, not in the name “chatgpt”
Highdocsign-docs.icuscore 55echoes docusign· no DNS
one-letter brand typo “docsign≈docusign”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Highdocsign-view.icuscore 55echoes docusign· blocked the probe
one-letter brand typo “docsign≈docusign”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Highdozelle.restscore 55echoes zelle· no DNS
brand in the name “zelle”TLD with a high abuse rate “rest”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highfidelitynationalclosings.homesscore 55echoes fidelity· registrar placeholder
brand in the name “fidelity”TLD with a high abuse rate “homes”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Highfinance-wallethubconnect.sbsscore 55echoes binance· no DNS
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “wallet”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”
Highfinance-wallets-alpha-prod-cdn.cloudscore 55echoes binance· no web server
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “wallet”many hyphens “4”very long name “30”
Highfindpaintacquisitionos.comscore 55echoes ionos· blocked the probe
brand in the name “ionos”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”form on a brand-styled page “has_form”

Same data as JSON: /api/zone/risk?day=2026-10-16&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.