Flagged newborn domains, Friday, October 23, 2026
2,480 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
TLD with a high abuse rate “click”nameserver domain born the same day “gaysexclipshard.click”
TLD with a high abuse rate “click”nameserver domain born the same day “gaysexclipshard.click”
TLD with a high abuse rate “click”nameserver domain born the same day “gaysexclipshard.click”
TLD with a high abuse rate “xyz”nameserver domain born the same day “sirglen.com”
ambiguous brand word “starling”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NETIM SAS”brand name and brand-styled page “starling”
TLD with a high abuse rate “click”nameserver domain born the same day “gaysexclipshard.click”
TLD with a high abuse rate “click”nameserver domain born the same day “gaysexclipshard.click”
TLD with a high abuse rate “click”nameserver domain born the same day “gaysexclipshard.click”
TLD with a high abuse rate “fun”nameserver domain born the same day “d6x1d83.top”
punycode name “동행데이케어센터 scripts=HANGUL”very long name “29”random-looking name “H=4.09”form submits over plain HTTP “http://xn--2n1buh808azke8pchzrcwdi8k.sho”
punycode name “첨단에스윌어학원 scripts=HANGUL”very long name “29”random-looking name “H=4.24”form submits over plain HTTP “http://xn--6j1bk21ahjcfdr9cik284azpr.sho”
punycode name “테일러수학전문학원 scripts=HANGUL”very long name “31”random-looking name “H=4.21”form submits over plain HTTP “http://xn--vl2bi4d35hd8eqyanxd98beuhca.s”
punycode name “능포상무태권도장 scripts=HANGUL”very long name “29”random-looking name “H=4.16”form submits over plain HTTP “http://xn--zf0br0hwyat1t88gr6kzhqeyf.sho”
lure words (login, verify, secure…) “account,recover,recovery”login form “has_form+login words”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “nationwide”
brand in the name “rakuten”form on a brand-styled page “has_form”
brand in the name “zelle”form on a brand-styled page “has_form”
lure words (login, verify, secure…) “reward,rewards”brand in page title, not in the name “costco”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
brand in the name “etsy”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “480 identical pages”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “airbnb”
lure words (login, verify, secure…) “package,update”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “recover,recovery”brand in page title, not in the name “cloudflare”
very long name “56”TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “whatsapp”
lure words (login, verify, secure…) “locked,unlock”brand in page title, not in the name “tiktok”
very long name “30”TLD with a high abuse rate “win”brand in page title, not in the name “cloudflare”
punycode name “双购城 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--jor26gd54d.top/”
lure words (login, verify, secure…) “customer”nameserver domain born the same day “aftersellanalytics.com”
lure words (login, verify, secure…) “portal”nameserver domain born the same day “aftersellforecast.com”
punycode name “河南塔菲大學 scripts=CJK”random-looking name “H=3.97”TLD with a high abuse rate “top”
punycode name “河南塔菲大学 scripts=CJK”random-looking name “H=4.06”TLD with a high abuse rate “top”
punycode name “外來器械管理 scripts=CJK”random-looking name “H=3.72”TLD with a high abuse rate “top”
punycode name “新型アルファード scripts=CJK/KATAKANA/KATAKANA-H”random-looking name “H=3.76”TLD with a high abuse rate “xyz”
punycode name “リジュンスカルプケア scripts=KATAKANA”random-looking name “H=3.72”TLD with a high abuse rate “xyz”
punycode name “年級管理平台 scripts=CJK”random-looking name “H=4.02”TLD with a high abuse rate “top”
punycode name “年级管理平台 scripts=CJK”random-looking name “H=4.02”TLD with a high abuse rate “top”
punycode name “外来器械管理 scripts=CJK”random-looking name “H=4.20”TLD with a high abuse rate “top”
punycode name “时代苍穹 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “リジュン使い方 scripts=CJK/HIRAGANA/KATAKANA”random-looking name “H=3.79”TLD with a high abuse rate “xyz”
punycode name “每日大賽 scripts=CJK”random-looking name “H=3.75”TLD with a high abuse rate “top”
punycode name “每日大赛 scripts=CJK”random-looking name “H=3.75”TLD with a high abuse rate “top”
punycode name “東油奶龍大學 scripts=CJK”random-looking name “H=3.82”TLD with a high abuse rate “top”
punycode name “爱满世界 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “愛滿世界 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “リジュンお得購入 scripts=CJK/HIRAGANA/KATAKANA”random-looking name “H=4.08”TLD with a high abuse rate “xyz”
punycode name “リジュン口コミ scripts=CJK/KATAKANA”random-looking name “H=3.73”TLD with a high abuse rate “xyz”
punycode name “杏彩体育 scripts=CJK”random-looking name “H=3.62”TLD with a high abuse rate “top”
Same data as JSON: /api/zone/risk?day=2026-10-23&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.