brand in the name “intesa”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “intuit”lure words (login, verify, secure…) “service,services”
brand in the name “intuit”brand name at a retail registrar “Porkbun”brand name at a watch-list registrar “Porkbun”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “kraken”lure words (login, verify, secure…) “support”brand name on a rarely-seen nameserver “bacloud.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
Model opinion: looks like abuse (target: Kraken), confidence 80%. An opinion, not a finding.
brand in the name “icloud”brand plus digits “l1-icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “service,services”brand name behind Cloudflare “cloudflare.com”
brand in the name “lloyds”lure words (login, verify, secure…) “account”
one-letter brand typo “looking≈booking”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “revolut”lure words (login, verify, secure…) “limited”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “4045 identical pages”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “chase”lure words (login, verify, secure…) “member”
brand spelled with digits “mitra77com→attcom”brand plus digits “mitra77com”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “revolut”brand name on a rarely-seen nameserver “onlydomains.com”brand name and brand-styled page “revolut”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Revolut), confidence 80%. An opinion, not a finding.
brand in the name “nintendo”very long name “30”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “nintendo”
Model opinion: looks benign, confidence 70%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”form on a brand-styled page “has_form”identical page on many newborns “1560 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”form on a brand-styled page “has_form”identical page on many newborns “1560 identical pages”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”form on a brand-styled page “has_form”identical page on many newborns “1560 identical pages”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”form on a brand-styled page “has_form”identical page on many newborns “1560 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “royalmail”lure words (login, verify, secure…) “track,tracking”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “paypal”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”
brand spelled with digits “ph4ntomxyz→phantom”brand plus digits “ph4ntomxyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CSL Computer Service Langenbach GmbH”
brand in the name “coinbase”lure words (login, verify, secure…) “portal”brand name behind Cloudflare “cloudflare.com”
brand in the name “ebay”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “fidelity”lure words (login, verify, secure…) “recover,recovery”TLD with a high abuse rate “icu”form on a brand-styled page “has_form”+1 more
Model opinion: looks benign, confidence 86%. An opinion, not a finding.
brand in the name “fidelity”lure words (login, verify, secure…) “recover,recovery”form on a brand-styled page “has_form”identical page on many newborns “1560 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “bradesco”TLD with a high abuse rate “click”brand in page title, not in the name “cloudflare”
brand in the name “revolut”lure words (login, verify, secure…) “verify”brand name on a rarely-seen nameserver “nsnamedns.net”
brand in the name “santander”lure words (login, verify, secure…) “support”
brand spelled with digits “saray15team→steam”brand plus digits “saray15team”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “tmobile”lure words (login, verify, secure…) “reset”
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “secure”TLD with a high abuse rate “top”
Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.
brand in the name “amazon”lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
brand in the name “stripe”lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
brand in the name “microsoft”lure words (login, verify, secure…) “service”brand name behind Cloudflare “cloudflare.com”
brand in the name “sharepoint”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: Microsoft (SharePoint)), confidence 77%. An opinion, not a finding.
brand in the name “apple”lure words (login, verify, secure…) “id,signin”brand name behind Cloudflare “cloudflare.com”
brand in the name “slack”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “4045 identical pages”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand in the name “ebay”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: unreachable when judged, confidence 72%. An opinion, not a finding.
brand in the name “squarespace”form on a brand-styled page “has_form”identical page on many newborns “1560 identical pages”
Model opinion: looks like abuse (target: Squarespace), confidence 60%. An opinion, not a finding.
brand in the name “starlink”form on a brand-styled page “has_form”identical page on many newborns “1560 identical pages”
Model opinion: looks like abuse (target: Starlink / Tesla), confidence 70%. An opinion, not a finding.
brand in the name “stripe”lure words (login, verify, secure…) “official”TLD with a high abuse rate “xyz”
brand in the name “stripe”lure words (login, verify, secure…) “security”TLD with a high abuse rate “xyz”
brand in the name “stripe”lure words (login, verify, secure…) “service,services”TLD with a high abuse rate “xyz”
brand in the name “gmail”brand plus digits “switi786gmail”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “switi786gmail”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “switimfumar597gmail”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “switimfumar597gmail”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”+3 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “switimyjaan597gmail”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “switimyjaan597gmail”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “switimysabbirumar295gmail”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: looks benign, confidence 60%. An opinion, not a finding.