Flagged newborn domains, Thursday, October 22, 2026

31 names at tier high or above in .top, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalmoonpay1.topscore 68· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: MoonPay), confidence 70%. An opinion, not a finding.

Criticaltiktokpremium.topscore 67echoes tiktok· active website
brand in the name “tiktok”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Openprovider”+1 more

Model opinion: looks like abuse (target: TikTok), confidence 80%. An opinion, not a finding.

Criticalprojectdocusign.topscore 62echoes docusign· active website
brand in the name “docusign”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: DocuSign), confidence 75%. An opinion, not a finding.

Hightiktok-mod-apk.topscore 59echoes tiktok· active website
brand in the name “tiktok”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “tiktok”

Model opinion: looks like abuse (target: TikTok), confidence 80%. An opinion, not a finding.

Highsecure-cloud.topscore 55echoes icloud· boilerplate page
one-letter brand typo “cloud≈icloud”lure words (login, verify, secure…) “secure”TLD with a high abuse rate “top”

Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.

Highsharepointsdocs.topscore 55echoes sharepoint· redirects elsewhere
brand in the name “sharepoint”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse (target: Microsoft (SharePoint)), confidence 77%. An opinion, not a finding.

High18tiktok.topscore 54echoes tiktok· no DNS
brand in the name “tiktok”brand plus digits “18tiktok”TLD with a high abuse rate “top”brand name at a retail registrar “Openprovider”
Highuspswi8v.topscore 54echoes usps· not probed yet
brand in the name “usps”brand plus digits “uspswi8v”TLD with a high abuse rate “top”brand name at a retail registrar “Dominet (HK) Limited”
High365onedrive.topscore 52echoes onedrive· not probed yet
brand in the name “onedrive”brand plus digits “365onedrive”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
Hightrinhquochung.topscore 52· active website
TLD with a high abuse rate “top”brand in page title, not in the name “zoom”form on a brand-styled page “has_form”form submits over plain HTTP “https://www.trinhquochung.top/”

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Highbici8c.topscore 51echoes cibc· no DNS
brand spelled with digits “bici8c→cibc”brand plus digits “bici8c”TLD with a high abuse rate “top”
Highbyxru5p5.topscore 51echoes usps· not probed yet
brand spelled with digits “byxru5p5→usps”brand plus digits “byxru5p5”TLD with a high abuse rate “top”
Highmicr0s0ft.topscore 51echoes microsoft· no web server
brand spelled with digits “micr0s0ft→microsoft”brand plus digits “micr0s0ft”TLD with a high abuse rate “top”
Highteleshop.topscore 50· active website
TLD with a high abuse rate “top”page impersonates a brand “Netflix”brand in page title, not in the name “telegram”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

High24h-9393x1.topscore 46· redirects elsewhere
TLD with a high abuse rate “top”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 40%. An opinion, not a finding.

Highcnnws.topscore 46· blocked the probe
TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Highdenkwertenz.topscore 46· blocked the probe
TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Highmuasamthongminh.topscore 46· active website
TLD with a high abuse rate “top”brand in page title, not in the name “tiktok”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highautotelegram.topscore 44echoes telegram· not probed yet
brand in the name “telegram”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
Highgxn-whatsapp.topscore 44echoes whatsapp· no DNS
brand in the name “whatsapp”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
Highkxf-whatsapp.topscore 44echoes whatsapp· no DNS
brand in the name “whatsapp”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
Highpawfecttreats.topscore 44· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”page pushes urgent payment “claim your reward”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Highpawlicious.topscore 44· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”page pushes urgent payment “claim your reward”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highpawsnacksome.topscore 44· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”page pushes urgent payment “claim your reward”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Highrealpaw.topscore 44· active website
TLD with a high abuse rate “top”page impersonates a brand “PayPal”page pushes urgent payment “claim your reward”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highshopifys.topscore 44echoes shopify· server error
brand in the name “shopify”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: Shopify), confidence 62%. An opinion, not a finding.

Highsun-whatsapp.topscore 44echoes whatsapp· no DNS
brand in the name “whatsapp”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
Highxks-whatsapp.topscore 44echoes whatsapp· no DNS
brand in the name “whatsapp”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
Highxng-whatsapp.topscore 44echoes whatsapp· no DNS
brand in the name “whatsapp”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
Highprobashi-pay.topscore 42· active website
lure words (login, verify, secure…) “pay”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”brand in page title, not in the name “google”
Highshorpify.topscore 42echoes shopify· no DNS
one-letter brand typo “shorpify≈shopify”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”

Same data as JSON: /api/zone/risk?day=2026-10-22&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.