Flagged newborn domains, Wednesday, October 21, 2026

29 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalexcel-forms-share-point-ms365-portal.workscore 92echoes sharepoint· active website
brand in the name “sharepoint”lure words (login, verify, secure…) “portal”many hyphens “5”very long name “36”+4 more

Model opinion: looks like phishing (target: Microsoft), confidence 95%. An opinion, not a finding.

Criticalfinance-profit-bot-italy.topscore 88echoes binance· active website
one-letter brand typo “finance≈binance”many hyphens “3”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like a scam, confidence 93%. An opinion, not a finding.

Criticalyangfan-cloud.clickscore 84echoes icloud· active website
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Netflix”+1 more

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalbestbuyy.sbsscore 76echoes bestbuy· active website
brand in the name “bestbuy”TLD with a high abuse rate “sbs”brand name on a rarely-seen nameserver “besthostingserver.com”brand name at a retail registrar “Spaceship, Inc.”+2 more

Model opinion: looks like phishing (target: Best Buy), confidence 82%. An opinion, not a finding.

Criticalstarlinkproxy.topscore 71echoes starlink· active website
brand in the name “starlink”TLD with a high abuse rate “top”brand name and brand-styled page “starlink”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalgoogleinfo.icuscore 70echoes google· active website
brand in the name “google”TLD with a high abuse rate “icu”brand name on a rarely-seen nameserver “vdsina.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”+1 more

Model opinion: looks like abuse (target: Google), confidence 72%. An opinion, not a finding.

Criticalwget-cloud.wikiscore 70echoes icloud· active website
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticallazadasingapure.appscore 69echoes lazada· active website
brand in the name “lazada”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “lazada”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Lazada), confidence 77%. An opinion, not a finding.

Criticalsavetiktok.appscore 69echoes tiktok· active website
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.

Critical1ordfilms.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalbbyvpn.homesscore 68· active website
TLD with a high abuse rate “homes”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalsterling-point-lordserial.sbsscore 68echoes starling· active website
one-letter brand typo “sterling≈starling”TLD with a high abuse rate “sbs”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalsspectrum.proscore 67echoes spectrum· active website
one-letter brand typo “sspectrum≈spectrum”brand name on a rarely-seen nameserver “adminvps.net”brand name and brand-styled page “spectrum”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalvanguardtax.solutionsscore 67echoes vanguard· active website
brand in the name “vanguard”page impersonates a brand “IRS”brand name and brand-styled page “vanguard”

Model opinion: looks benign, confidence 77%. An opinion, not a finding.

Criticalhuntingseasonroblox.wikiscore 65echoes roblox· active website
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticaldramaxbox.topscore 64echoes xbox· active website
brand in the name “xbox”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “google”

Model opinion: looks like abuse (target: Google Play), confidence 82%. An opinion, not a finding.

Criticalbestboy.devscore 60echoes bestbuy· active website
one-letter brand typo “bestboy≈bestbuy”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CloudFlare, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalcom-googlesearch-search-req-rvn-chrome-ob-utf-8.sitescore 60echoes google· active website
brand in the name “google”many hyphens “8”very long name “47”brand plus digits “com-googlesearch-search-req-rvn-chrome-o”+2 more

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalgetline.storescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalguardrc.comscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “outlook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalmojarastudios.comscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalmoviepickem.appscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalnetpremium.storescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalnomark.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “shopify”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalrealaurorarobinhood.xyzscore 60echoes robinhood· active website
brand in the name “robinhood”TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: looks like a scam (target: Robinhood), confidence 74%. An opinion, not a finding.

Criticalsmtptest.devscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “outlook”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalstandardglobal-finance.livescore 60echoes binance· active website
one-letter brand typo “finance≈binance”brand name on a rarely-seen nameserver “zencorehost.com”brand name at a retail registrar “Global Domain Group LLC”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 90%. An opinion, not a finding.

Criticalthedime.newsscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalvolero.livescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-10-21&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.