Flagged newborn domains, Saturday, October 17, 2026

57 names at tier medium or above in .site, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalroyalmailtracking.sitescore 80echoes royalmail· active website
brand in the name “royalmail”lure words (login, verify, secure…) “track,tracking”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Royal Mail), confidence 77%. An opinion, not a finding.

Criticalgoogle777.sitescore 64echoes google· active website
brand in the name “google”brand plus digits “google777”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Google), confidence 60%. An opinion, not a finding.

Criticalrusaairductservices.sitescore 64echoes usaa· active website
brand in the name “usaa”lure words (login, verify, secure…) “service,services”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticalbrewgrambot.sitescore 60· active website
page impersonates a brand “MetaMask”brand in page title, not in the name “telegram”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalvazouja.sitescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “telegram”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 75%. An opinion, not a finding.

Highvanguard-armament.sitescore 59echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”brand name and brand-styled page “vanguard”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Highid-icloud.sitescore 55echoes icloud· empty page
brand in the name “icloud”lure words (login, verify, secure…) “id”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Apple), confidence 75%. An opinion, not a finding.

Highvanguardautomanaged.sitescore 55echoes vanguard· registrar placeholder
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: suspicious (target: Vanguard), confidence 60%. An opinion, not a finding.

Highadobeproject.sitescore 54echoes adobe· registrar placeholder
brand in the name “adobe”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3510 identical pages”
Highchatgptnews.sitescore 54echoes chatgpt· registrar placeholder
brand in the name “chatgpt”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3510 identical pages”
Highxc-quickbooks.sitescore 53echoes quickbooks· empty page
brand in the name “quickbooks”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”brand name and brand-styled page “quickbooks”

Model opinion: looks like abuse (target: Intuit QuickBooks), confidence 80%. An opinion, not a finding.

Highkakao-loan.sitescore 50echoes kakao· not probed yet
brand in the name “kakao”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Highzanvichimneyservices.sitescore 50· active website
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “chase”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highcidadeshopee.sitescore 44echoes shopee· active website
brand in the name “shopee”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Highmapsgoogle.sitescore 44echoes google· empty page
brand in the name “google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”

Model opinion: looks like abuse (target: Google), confidence 77%. An opinion, not a finding.

Highmeudeliveryia.sitescore 44· active website
lure words (login, verify, secure…) “delivery”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highplay-google.sitescore 44echoes google· active website
brand in the name “google”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”

Model opinion: suspicious, confidence 65%. An opinion, not a finding.

Highconnbase.sitescore 42echoes coinbase· active website
one-letter brand typo “connbase≈coinbase”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”

Model opinion: looks like abuse (target: Coinbase), confidence 80%. An opinion, not a finding.

Highfreestream.sitescore 42· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”

Model opinion: looks like a scam (target: Netflix), confidence 77%. An opinion, not a finding.

Highmm-azon.sitescore 42echoes amazon· placeholder page
one-letter brand typo “mmazon≈amazon”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”

Model opinion: looks like abuse (target: Amazon), confidence 70%. An opinion, not a finding.

Highusepal.sitescore 42· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”
Highveilguard.sitescore 42· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “chatgpt”
Highveliguard.sitescore 42· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “chatgpt”
Mediumarcticway.sitescore 38· active website
brand in page title, not in the name “amazon”form on a brand-styled page “has_form”
Mediumbigcess.sitescore 38· active website
brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”
Mediumcakeaway.sitescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumdeadrail.sitescore 38· active website
brand in page title, not in the name “chase”form on a brand-styled page “has_form”
Mediumdescargaspro.sitescore 38· redirects elsewhere
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediumdingdango.sitescore 38· redirects elsewhere
brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”
Mediumdomorakz.sitescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumikeero.sitescore 38· active website
brand in page title, not in the name “facebook”form on a brand-styled page “has_form”
Mediumkokototoweb.sitescore 38· active website
brand in page title, not in the name “google”form on a brand-styled page “has_form”
Mediummarketingafricaonline.sitescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumprofilee.sitescore 38· active website
brand in page title, not in the name “adobe”form on a brand-styled page “has_form”
Mediumrubick.sitescore 38· active website
brand in page title, not in the name “uniswap”form on a brand-styled page “has_form”
Mediumsitepoke.sitescore 38· redirects elsewhere
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumsupersimfacil.sitescore 38· blocked the probe
brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Mediumthehealingera.sitescore 38· active website
brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Mediumtt-quick-books.sitescore 38echoes quickbooks· empty page
brand in the name “quickbooks”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
Mediumupt-quick-books.sitescore 38echoes quickbooks· empty page
brand in the name “quickbooks”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”
Mediumuserappeal-tiktok.sitescore 38echoes tiktok· no web server
brand in the name “tiktok”brand name at a retail registrar “Turkticaret.net Yazılım Hizmetleri Sanay”
Mediumvoupedir.sitescore 38· active website
brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”
Mediumpawpal-ph.sitescore 36echoes paypal· no DNS
one-letter brand typo “pawpal≈paypal”brand name at a retail registrar “Dominet (HK) Limited”
Mediumrewardscout.sitescore 32· active website
lure words (login, verify, secure…) “reward,rewards”brand in page title, not in the name “namecheap”
Mediumalwaha.sitescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “61 identical pages”
Mediumbos-an138.sitescore 30· active website
page asks for credentials “Login to your Account”
Mediumggbank.sitescore 30· active website
page asks for credentials “Sign in to your account”
Mediumhealthdiscussionhub.sitescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “61 identical pages”
Mediumlightlife.sitescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “61 identical pages”
Mediumpurehealthsupps.sitescore 30· registrar placeholder
brand in page title, not in the name “hostinger”identical page on many newborns “61 identical pages”

Same data as JSON: /api/zone/risk?day=2026-10-17&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.