Flagged newborn domains, Tuesday, October 20, 2026
2,368 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
ambiguous brand word “booking”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CNOBIN INFORMATION TECHNOLOGY LIMITED”brand name and brand-styled page “booking”
punycode name “피닉스파크골프양산대리점 scripts=HANGUL”very long name “40”random-looking name “H=4.24”form submits over plain HTTP “http://xn--bb0bm5i0eu6xsnjx3c33gf0feww85”
very long name “52”TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”
very long name “29”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
very long name “29”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
lure words (login, verify, secure…) “access”many hyphens “3”very long name “37”TLD with a high abuse rate “top”+1 more
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “whatsapp”
very long name “28”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
punycode name “从婉婷 scripts=CJK”TLD with a high abuse rate “fun”form submits over plain HTTP “http://xn--0mqt3z7d.fun/”
punycode name “雨舟 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--dd1aq93b.top/”
punycode name “通购城 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--uisx55jg3b.top/”
many hyphens “3”nameserver domain born the same day “vp1vps1pro.pro”
punycode name “张爱玲去死 scripts=CJK”random-looking name “H=3.73”TLD with a high abuse rate “icu”
punycode name “太湖縣慈善總會 scripts=CJK”random-looking name “H=3.97”TLD with a high abuse rate “top”
punycode name “二氧化硅炒饭 scripts=CJK”random-looking name “H=4.06”TLD with a high abuse rate “top”
punycode name “二氧化硅炒飯 scripts=CJK”random-looking name “H=4.06”TLD with a high abuse rate “top”
punycode name “河南奶龙学院 scripts=CJK”random-looking name “H=3.97”TLD with a high abuse rate “work”
punycode name “广深马云大圈 scripts=CJK”random-looking name “H=4.11”TLD with a high abuse rate “xyz”
punycode name “开云体育 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “開云體育 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “国家抖音商城 scripts=CJK”random-looking name “H=3.78”TLD with a high abuse rate “xyz”
punycode name “化州市人民医院 scripts=CJK”random-looking name “H=4.05”TLD with a high abuse rate “top”
punycode name “化州市人民醫院 scripts=CJK”random-looking name “H=4.02”TLD with a high abuse rate “top”
punycode name “人力報表推送 scripts=CJK”random-looking name “H=3.69”TLD with a high abuse rate “top”
punycode name “부산마스터설비 scripts=HANGUL”random-looking name “H=3.88”TLD with a high abuse rate “xyz”
punycode name “视频生成器 scripts=CJK”random-looking name “H=3.85”TLD with a high abuse rate “top”
punycode name “視頻生成器 scripts=CJK”random-looking name “H=3.85”TLD with a high abuse rate “top”
punycode name “新疆奶蛙大學 scripts=CJK”random-looking name “H=3.68”TLD with a high abuse rate “top”
punycode name “應急奶龍大學 scripts=CJK”random-looking name “H=3.82”TLD with a high abuse rate “top”
punycode name “新疆奶蛙大学 scripts=CJK”random-looking name “H=3.89”TLD with a high abuse rate “top”
punycode name “应急奶龙大学 scripts=CJK”random-looking name “H=3.72”TLD with a high abuse rate “top”
punycode name “杭州电子奶龙大学 scripts=CJK”random-looking name “H=3.97”TLD with a high abuse rate “icu”
punycode name “허스모아 scripts=HANGUL”random-looking name “H=3.77”TLD with a high abuse rate “quest”
punycode name “东莞奶龙理工 scripts=CJK”random-looking name “H=3.97”TLD with a high abuse rate “top”
brand in page title, not in the name “hostinger”identical page on many newborns “80 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “80 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “80 identical pages”
TLD with a high abuse rate “work”page impersonates a brand “Office 365”
Same data as JSON: /api/zone/risk?day=2026-10-20&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.