Flagged newborn domains, Friday, October 16, 2026

458 names at tier low or above in .online, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalmycostcorewards0029.onlinescore 78echoes costco· active website
brand in the name “costco”lure words (login, verify, secure…) “reward,rewards”brand plus digits “mycostcorewards0029”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse (target: Costco), confidence 80%. An opinion, not a finding.

Criticalapp-restore.onlinescore 60· active website
page impersonates a brand “Apple ID”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticaljerdify.onlinescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticallassine-finance.onlinescore 60echoes binance· active website
one-letter brand typo “finance≈binance”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Highstarling-aegistra.onlinescore 57echoes starling· active website
ambiguous brand word “starling”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+2 more

Model opinion: looks like a scam, confidence 88%. An opinion, not a finding.

Highiamsecure-cloud.onlinescore 55echoes icloud· boilerplate page
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “secure”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Highvenmosupportx.onlinescore 55echoes venmo· placeholder page
brand in the name “venmo”lure words (login, verify, secure…) “support”brand name on a rarely-seen nameserver “doveserver.com”

Model opinion: looks like abuse (target: Venmo), confidence 80%. An opinion, not a finding.

Highvenmoverify.onlinescore 55echoes venmo· not probed yet
brand in the name “venmo”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”
Highwarreninmotionoutlook.onlinescore 55echoes outlook· boilerplate page
brand in the name “outlook”form on a brand-styled page “has_form”identical page on many newborns “62 identical pages”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Highadobeexpress.onlinescore 54echoes adobe· boilerplate page
brand in the name “adobe”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”identical page on many newborns “44 identical pages”

Model opinion: looks like abuse (target: Adobe), confidence 74%. An opinion, not a finding.

Highhurusaa.onlinescore 54echoes usaa· registrar placeholder
brand in the name “usaa”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4257 identical pages”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Highmobile-bundle.onlinescore 54echoes tmobile· redirects elsewhere
one-letter brand typo “mobile≈tmobile”form on a brand-styled page “has_form”brand name redirects elsewhere “verificaitonnow.com”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highre-volt.onlinescore 54echoes revolut· active website
one-letter brand typo “revolt≈revolut”brand name at a retail registrar “Gransy, s.r.o.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highproxyopenai.onlinescore 52echoes openai· redirects elsewhere
brand in the name “openai”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”brand name redirects elsewhere “qcloud.com”

Model opinion: looks like abuse (target: OpenAI), confidence 60%. An opinion, not a finding.

Highmymagicgmail.onlinescore 50echoes gmail· boilerplate page
brand in the name “gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Highihateairbnb.onlinescore 48echoes airbnb· boilerplate page
brand in the name “airbnb”brand name at a retail registrar “Network Solutions, LLC”identical page on many newborns “48 identical pages”

Model opinion: looks benign, confidence 74%. An opinion, not a finding.

Highbangkokbanktoplottery.onlinescore 44· active website
page asks for credentials “Login to your Account”login form “has_form+login words”
Highjaguarhotels.onlinescore 44· active website
page asks for credentials “Sign in to your account”login form “has_form+login words”

Model opinion: looks like a scam, confidence 65%. An opinion, not a finding.

Hightelegram-advanced.onlinescore 44echoes telegram· robots.txt denied
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
Hightrackorders.onlinescore 44· active website
lure words (login, verify, secure…) “track”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Highfinalpay.onlinescore 42· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”

Model opinion: suspicious (target: PayPal), confidence 72%. An opinion, not a finding.

Highneoflix.onlinescore 42echoes netflix· empty page
one-letter brand typo “neoflix≈netflix”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highpremvault.onlinescore 42· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Medium1stairporttaxis.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Medium39741.onlinescore 38· redirects elsewhere
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumaliapicloud.onlinescore 38echoes icloud· excluded
brand in the name “icloud”brand name at a retail registrar “GoDaddy.com, LLC”
Mediumalovpanel.onlinescore 38· active website
brand in page title, not in the name “instagram”form on a brand-styled page “has_form”
Mediumbigxbudz.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumbrblack99.onlinescore 38· redirects elsewhere
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumcheckic.onlinescore 38· active website
brand in page title, not in the name “walmart”form on a brand-styled page “has_form”
Mediumchodey.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumcompareplanos.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumcraftedboard.onlinescore 38· active website
brand in page title, not in the name “facebook”form on a brand-styled page “has_form”
Mediumcurso-ia.onlinescore 38· active website
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumdmkazisalman.onlinescore 38· parked with ads
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumdoohub.onlinescore 38· active website
brand in page title, not in the name “booking”form on a brand-styled page “has_form”
Mediumeagdigital.onlinescore 38· active website
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumeletrosap.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumembrepartspecasdiesel.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumeth-binance.onlinescore 38echoes binance· no DNS
brand in the name “binance”brand name at a retail registrar “GoDaddy.com, LLC”
Mediumfycprojectcalendar.onlinescore 38· active website
brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Mediumfyn4ucom.onlinescore 38· active website
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumgrandmaitreborel.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumgtacandheating.onlinescore 38· active website
brand in page title, not in the name “facebook”form on a brand-styled page “has_form”
Mediumhealthplate.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumingridweb.onlinescore 38· active website
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Mediumjustwriteit.onlinescore 38· active website
brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”
Mediumkeyloot.onlinescore 38· active website
brand in page title, not in the name “steam”form on a brand-styled page “has_form”
Mediumklarseitestudio.onlinescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumkursachev.onlinescore 38· redirects elsewhere
brand in page title, not in the name “telegram”form on a brand-styled page “has_form”

Same data as JSON: /api/zone/risk?day=2026-10-16&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.