Flagged newborn domains, Friday, October 16, 2026
2,667 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “山东奶龙职业技术学院 scripts=CJK”very long name “35”random-looking name “H=4.29”TLD with a high abuse rate “icu”
lure words (login, verify, secure…) “portal”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “portal”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “portal”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “bonus”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
one-letter brand typo “mobile≈tmobile”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “parcel,track”many hyphens “3”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
very long name “28”brand in page title, not in the name “hostinger”identical page on many newborns “64 identical pages”
one-letter brand typo “mailchinp≈mailchimp”brand name on a rarely-seen nameserver “impreza.host”
one-letter brand typo “lcloud≈icloud”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “parcel”page impersonates a brand “DHL”form submits over plain HTTP “https://www.orbitexparcel.online/”
lure words (login, verify, secure…) “track”TLD with a high abuse rate “fun”brand in page title, not in the name “telegram”
lure words (login, verify, secure…) “reward,rewards”TLD with a high abuse rate “xyz”page pushes urgent payment “Claim Your Bonus”
lure words (login, verify, secure…) “win”TLD with a high abuse rate “lol”brand in page title, not in the name “telegram”
punycode name “fórmula-1-lenovo-gran-premio-de-españa s”many hyphens “6”very long name “38”form submits over plain HTTP “http://xn--frmula-1-lenovo-gran-premio-d”
random-looking name “H=3.73”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
punycode name “바이오포톤유성점 scripts=HANGUL”very long name “29”random-looking name “H=4.16”form submits over plain HTTP “http://xn--9g3bo7guye22a7lj4al40cqje.sho”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “portal”many hyphens “4”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “track,tracking”brand in page title, not in the name “tiktok”
lure words (login, verify, secure…) “portal,reward”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
very long name “33”TLD with a high abuse rate “work”brand in page title, not in the name “cloudflare”
punycode name “奶京龍業大學 scripts=CJK”random-looking name “H=3.98”TLD with a high abuse rate “top”
punycode name “아이파크무등산 scripts=HANGUL”random-looking name “H=3.97”TLD with a high abuse rate “xyz”
punycode name “糯米团子 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “奶龙早八 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “八一奶龙大学 scripts=CJK”random-looking name “H=3.68”TLD with a high abuse rate “xyz”
punycode name “晴川生物 scripts=CJK”random-looking name “H=3.66”TLD with a high abuse rate “top”
punycode name “南宮國際官網 scripts=CJK”random-looking name “H=4.11”TLD with a high abuse rate “top”
punycode name “好想玩原神 scripts=CJK”random-looking name “H=3.97”TLD with a high abuse rate “icu”
punycode name “太原奶蛙大学 scripts=CJK”random-looking name “H=3.88”TLD with a high abuse rate “top”
punycode name “太原奶蛙大學 scripts=CJK”random-looking name “H=3.92”TLD with a high abuse rate “top”
punycode name “芙兰朵露脚香香喵 scripts=CJK”random-looking name “H=3.94”TLD with a high abuse rate “lol”
punycode name “챔피언스시티 scripts=HANGUL”random-looking name “H=4.02”TLD with a high abuse rate “xyz”
punycode name “東北奶蛙大學 scripts=CJK”random-looking name “H=4.02”TLD with a high abuse rate “top”
punycode name “纸上年华 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “紙上年華 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “華為機器人 scripts=CJK”random-looking name “H=3.73”TLD with a high abuse rate “top”
punycode name “田园农商 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “대표상담전화 scripts=HANGUL”random-looking name “H=4.01”TLD with a high abuse rate “xyz”
punycode name “糯米團子 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “吴健明瑶光 scripts=CJK”random-looking name “H=3.85”TLD with a high abuse rate “icu”
punycode name “奶龍醫科大學 scripts=CJK”random-looking name “H=4.02”TLD with a high abuse rate “top”
punycode name “沈陽奶龍大學 scripts=CJK”random-looking name “H=4.01”TLD with a high abuse rate “top”
punycode name “我是奶龙大学 scripts=CJK”random-looking name “H=4.12”TLD with a high abuse rate “icu”
punycode name “辽宁奶蛙大学 scripts=CJK”random-looking name “H=3.93”TLD with a high abuse rate “icu”
punycode name “沈阳奶龙大学 scripts=CJK”random-looking name “H=4.01”TLD with a high abuse rate “top”
punycode name “江苏奶蛙大学 scripts=CJK”random-looking name “H=3.68”TLD with a high abuse rate “icu”
punycode name “海淀奶龙大学 scripts=CJK”random-looking name “H=3.92”TLD with a high abuse rate “icu”
Same data as JSON: /api/zone/risk?day=2026-10-16&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.