Flagged newborn domains, Friday, October 16, 2026

68 names at tier medium or above in .org, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highfacebookdj.orgscore 56echoes facebook· active website
brand in the name “facebook”brand name at a retail registrar “Tucows Domains Inc.”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Facebook), confidence 60%. An opinion, not a finding.

Highblnance.orgscore 55echoes binance· registrar placeholder
one-letter brand typo “blnance≈binance”form on a brand-styled page “has_form”identical page on many newborns “1723 identical pages”

Model opinion: looks like abuse (target: Binance), confidence 80%. An opinion, not a finding.

Highhelpdesk-gmail.orgscore 55echoes gmail· not probed yet
brand in the name “gmail”lure words (login, verify, secure…) “helpdesk”
Highhelpdesk-google.orgscore 55echoes google· not probed yet
brand in the name “google”lure words (login, verify, secure…) “helpdesk”
Highhs-bc-support.orgscore 55echoes hsbc· no DNS
brand in the name “hsbc”lure words (login, verify, secure…) “support”brand name on a rarely-seen nameserver “alexhost.com”
Highphoenixvanguard.orgscore 55echoes vanguard· empty page
brand in the name “vanguard”brand name on a rarely-seen nameserver “awsdns-12.com”brand name at a retail registrar “Amazon Registrar, Inc.”brand name and brand-styled page “vanguard”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Highuspstracking.orgscore 55echoes usps· not probed yet
brand in the name “usps”lure words (login, verify, secure…) “track,tracking”
Highheadaihubspot.orgscore 54echoes hubspot· boilerplate page
brand in the name “hubspot”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “899 identical pages”

Model opinion: suspicious (target: HubSpot), confidence 50%. An opinion, not a finding.

Highintuitivevision.orgscore 54echoes intuit· registrar placeholder
brand in the name “intuit”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4257 identical pages”
Hightickets-gmail.orgscore 54echoes gmail· boilerplate page
brand in the name “gmail”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “1147 identical pages”

Model opinion: looks like abuse (target: Gmail (Google)), confidence 70%. An opinion, not a finding.

Highyogurtgazelle.orgscore 54echoes zelle· boilerplate page
brand in the name “zelle”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “899 identical pages”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highayw-finance.orgscore 52echoes binance· registrar placeholder
one-letter brand typo “finance≈binance”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “4257 identical pages”
Highwordpress-gr.orgscore 52echoes wordpress· redirects elsewhere
brand in the name “wordpress”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Enartia Single Member S.A.”brand name redirects elsewhere “advision.gr”

Model opinion: looks benign, confidence 45%. An opinion, not a finding.

Highado-berlin.orgscore 50echoes adobe· not probed yet
brand in the name “adobe”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Highamazonvalleyacademy.orgscore 50echoes amazon· no DNS
brand in the name “amazon”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Highbinancegg.orgscore 50echoes binance· no DNS
brand in the name “binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Highcounterintuit.orgscore 50echoes intuit· not probed yet
brand in the name “intuit”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
Highdteamunlocked.orgscore 50· active website
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Highsavebaywood.orgscore 50echoes ebay· parked, for sale
brand in the name “ebay”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”identical page on many newborns “1723 identical pages”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highsreamunlocked.orgscore 50· active website
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Highstaemunlocked.orgscore 50· active website
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: SteamUnlocked), confidence 86%. An opinion, not a finding.

Highsteeamunlocked.orgscore 50· active website
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Highstemaunlocked.orgscore 50· active website
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: SteamUnlocked), confidence 85%. An opinion, not a finding.

Highstesmunlocked.orgscore 50· active website
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: SteamUnlocked), confidence 86%. An opinion, not a finding.

Highstteamunlocked.orgscore 50· active website
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: SteamUnlocked), confidence 86%. An opinion, not a finding.

Hightelegram-sd.orgscore 50echoes telegram· blocked the probe
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Highcorsitelegram.orgscore 48echoes telegram· boilerplate page
brand in the name “telegram”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “3747 identical pages”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Highmeetamask.orgscore 48echoes metamask· not probed yet
one-letter brand typo “meetamask≈metamask”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Highamazon-ai.orgscore 44echoes amazon· empty page
brand in the name “amazon”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”

Model opinion: suspicious (target: Amazon), confidence 65%. An opinion, not a finding.

Highbnk-hsb-c.orgscore 44echoes hsbc· no DNS
brand in the name “hsbc”brand name on a rarely-seen nameserver “alexhost.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
Highchatgptmillionaire.orgscore 44echoes chatgpt· not probed yet
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Highcollecticloud.orgscore 44echoes icloud· not probed yet
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Highhukumteknologi.orgscore 44· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”form submits over plain HTTP “http://hukumteknologi.org/login”

Model opinion: looks benign, confidence 66%. An opinion, not a finding.

Highsteaumnlocked.orgscore 44· active website
lure words (login, verify, secure…) “locked”brand in page title, not in the name “steam”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Highhwg-cloud.orgscore 42echoes icloud· active website
one-letter brand typo “cloud≈icloud”brand name on a rarely-seen nameserver “domainssaubillig.de”brand name at a retail registrar “Vautron Rechenzentrum AG”

Model opinion: looks benign, confidence 92%. An opinion, not a finding.

Highimiglioricasinononaams.orgscore 42· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Mediumadier.orgscore 38· active website
brand in page title, not in the name “tiktok”form on a brand-styled page “has_form”
Mediumanchorstats.orgscore 38· redirects elsewhere
brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Mediumapextransformationsolutions.orgscore 38· active website
brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”
Mediumcladrinnovations.orgscore 38· redirects elsewhere
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumemojiaesthetic.orgscore 38· active website
brand in page title, not in the name “instagram”form on a brand-styled page “has_form”
Mediumfocshq.orgscore 38· parked, for sale
brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Mediumgudalabs.orgscore 38· active website
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumhularides.orgscore 38· active website
brand in page title, not in the name “uber”form on a brand-styled page “has_form”
Mediumimpactfulpr.orgscore 38· active website
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Mediumkadinkotasukamakmue.orgscore 38· active website
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Mediumkidsafemail.orgscore 38· redirects elsewhere
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumlagi2027slc.orgscore 38· active website
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Mediumnswpedia.orgscore 38· active website
brand in page title, not in the name “nintendo”form on a brand-styled page “has_form”
Mediumpafikecbalikbukit.orgscore 38· active website
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”

Same data as JSON: /api/zone/risk?day=2026-10-16&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.