Flagged newborn domains, Tuesday, October 20, 2026

28 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalroamrobinhood.funscore 85echoes robinhood· active website
brand in the name “robinhood”TLD with a high abuse rate “fun”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+2 more

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticalslot155-mobile.sitescore 74echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “slot155-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+2 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalshopiify.storescore 72echoes shopify· active website
one-letter brand typo “shopiify≈shopify”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “shopify”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Shopify), confidence 80%. An opinion, not a finding.

Criticaldddtiktok.comscore 69echoes tiktok· active website
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: TikTok), confidence 62%. An opinion, not a finding.

Criticalshopifyy.sitescore 69echoes shopify· active website
brand in the name “shopify”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “shopify”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Shopify), confidence 85%. An opinion, not a finding.

Criticaltiktokmodcloud.onlinescore 69echoes tiktok· active website
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: TikTok), confidence 74%. An opinion, not a finding.

Criticalvanguardmedia.beerscore 69echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalbuychatgpt.onlinescore 68echoes chatgpt· active website
brand in the name “chatgpt”brand in page title, not in the name “openai”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: OpenAI), confidence 68%. An opinion, not a finding.

Criticallongthe500.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Coinbase”brand in page title, not in the name “coinbase”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalquarterquill.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 56%. An opinion, not a finding.

Criticalshed.workscore 68· active website
TLD with a high abuse rate “work”page impersonates a brand “Microsoft 365”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalview-release-mail.livescore 68· active website
page asks for credentials “Verify your identity”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Google), confidence 98%. An opinion, not a finding.

Criticaltaobaospreadsheet.skinscore 67echoes taobao· active website
brand in the name “taobao”TLD with a high abuse rate “skin”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks like abuse (target: Taobao), confidence 74%. An opinion, not a finding.

Criticalmedvedroblox.wikiscore 65echoes roblox· active website
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalopenaisubscription.lolscore 64echoes openai· active website
brand in the name “openai”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “apple”

Model opinion: looks like abuse (target: OpenAI), confidence 70%. An opinion, not a finding.

Criticalamazonbonuspics.lifescore 62echoes amazon· active website
brand in the name “amazon”lure words (login, verify, secure…) “bonus”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Amazon), confidence 77%. An opinion, not a finding.

Criticalgovworkpermitau.onlinescore 62echoes itau· active website
brand in the name “itau”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticalwificloud.shopscore 62echoes icloud· active website
brand in the name “icloud”brand name at a retail registrar “Namecheap, Inc.”brand name at a watch-list registrar “Namecheap, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalbublleshopiing.shopscore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticaldnwrr.clubscore 60· active website
page impersonates a brand “Apple ID”brand in page title, not in the name “telegram”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 72%. An opinion, not a finding.

Criticaldroplox.onlinescore 60echoes dropbox· active website
one-letter brand typo “droplox≈dropbox”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalmonitorglobalvenezuela.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalmyapp-ppl-survey.infoscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: PayPal), confidence 95%. An opinion, not a finding.

Criticalpayersanscarte.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalphantomk.bondscore 60echoes phantom· active website
one-letter brand typo “phantomk≈phantom”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalppl-myapp-survey.infoscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: PayPal), confidence 95%. An opinion, not a finding.

Criticalrainforgarden.shopscore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticalwagmart.shopscore 60echoes walmart· active website
one-letter brand typo “wagmart≈walmart”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-10-20&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.