Flagged newborn domains, Monday, October 19, 2026

32 names at tier low or above in .vip, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highvuicloudservice.vipscore 55echoes icloud· empty page
brand in the name “icloud”lure words (login, verify, secure…) “service”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highwilsonroisicloud.vipscore 55echoes icloud· empty page
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”

Model opinion: looks like abuse (target: Apple), confidence 60%. An opinion, not a finding.

Highcoinbase66.vipscore 52echoes coinbase· empty page
brand in the name “coinbase”brand plus digits “coinbase66”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”

Model opinion: looks like phishing (target: Coinbase), confidence 72%. An opinion, not a finding.

Highfedex-mhfgn.vipscore 50echoes fedex· no DNS
brand in the name “fedex”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Highfedex-vbgfs.vipscore 50echoes fedex· empty page
brand in the name “fedex”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Highfedex-vfghbgf.vipscore 50echoes fedex· no DNS
brand in the name “fedex”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Hightiktokvip.vipscore 44echoes tiktok· no DNS
brand in the name “tiktok”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
Highl7-amazonia777.vipscore 42echoes amazon· empty page
brand in the name “amazon”brand plus digits “l7-amazonia777”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Gname.com Pte. Ltd.”+1 more

Model opinion: looks like abuse, confidence 65%. An opinion, not a finding.

Low68gbvip88.vipscore 20· blocked the probe
brand in page title, not in the name “cloudflare”
Lowamgniuniu.vipscore 20· active website
brand in page title, not in the name “telegram”
Lowbunnihills.vipscore 20· active website
brand in page title, not in the name “instagram”
Lowchutecerto.vipscore 20· blocked the probe
brand in page title, not in the name “cloudflare”
Lowcreonix.vipscore 20· active website
brand in page title, not in the name “tiktok”
Lowcuetick.vipscore 20· active website
brand in page title, not in the name “apple”
Loweliahills.vipscore 20· active website
brand in page title, not in the name “instagram”
Lowemprendeshop.vipscore 20· active website
brand in page title, not in the name “whatsapp”
Loweyey.vipscore 20· blocked the probe
brand in page title, not in the name “cloudflare”
Lowkennedyb.vipscore 20· active website
brand in page title, not in the name “instagram”
Lowsy666.vipscore 20· active website
brand in page title, not in the name “google”
Lowxn--eett41g.vipscore 18· blocked the probe
punycode name “花寻 scripts=CJK”
Lowxn--iqu981ehfjx8i.vipscore 18· boilerplate page
punycode name “轻舞飞扬 scripts=CJK”
Lowxn--kivp6lrum.vipscore 18· empty page
punycode name “沈程星 scripts=CJK”
Lowxn--oct1gj96bw1g.vipscore 18· active website
punycode name “小猪民宿 scripts=CJK”
Lowxn--piropg-5ta.vipscore 18· not probed yet
punycode name “pirãopg scripts=LATIN”
Lowxn--tlq0ks12b.vipscore 18· no DNS
punycode name “广交会 scripts=CJK”
Lowxn--vqqx15ew64a.vipscore 18· boilerplate page
punycode name “何高涛 scripts=CJK”
Lowxn--xu0ax8h.vipscore 18· no DNS
punycode name “蓝羽 scripts=CJK”
Lowbohdz.vipscore 14· active website
page pushes urgent payment “Claim your reward”
Lowjkyai.vipscore 14· empty page
login form “has_form+login words”
Lownewspub.vipscore 14· active website
login form “has_form+login words”
Lowrewild.vipscore 14· redirects elsewhere
login form “has_form+login words”
lure words (login, verify, secure…) “service”very long name “32”

Same data as JSON: /api/zone/risk?day=2026-10-19&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.