brand in the name “onedrive”lure words (login, verify, secure…) “access”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”
brand in the name “onedrive”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”+1 more
Model opinion: looks like abuse (target: Microsoft (OneDrive)), confidence 70%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
brand in the name “openai”TLD with a high abuse rate “fun”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
one-letter brand typo “opensi≈openai”brand name on a rarely-seen nameserver “gofruits.co”form on a brand-styled page “has_form”brand name redirects elsewhere “fruits.co”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
brand in the name “outlook”lure words (login, verify, secure…) “portal”brand name on a rarely-seen nameserver “parktons.com”
brand in the name “paypal”lure words (login, verify, secure…) “wallet”
brand in the name “wordpress”lure words (login, verify, secure…) “update”
brand in the name “quickbooks”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “intuit”
Model opinion: looks like phishing (target: Intuit (QuickBooks)), confidence 80%. An opinion, not a finding.
brand in the name “google”many hyphens “3”brand plus digits “play-google-88m-x1”brand name behind Cloudflare “cloudflare.com”+1 more
Model opinion: looks like abuse (target: Google (Google Play)), confidence 77%. An opinion, not a finding.
brand in the name “google”many hyphens “3”brand plus digits “play-google-88m-x2”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “google”many hyphens “3”brand plus digits “play-google-88m-x3”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “bradesco”lure words (login, verify, secure…) “portal”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”+1 more
brand in the name “wordpress”lure words (login, verify, secure…) “portal”TLD with a high abuse rate “xyz”
brand in the name “ebay”lure words (login, verify, secure…) “prize”brand name behind Cloudflare “cloudflare.com”
Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.
brand in the name “linkedin”lure words (login, verify, secure…) “pay”many hyphens “3”
brand in the name “ledger”lure words (login, verify, secure…) “recover,recovery”brand name behind Cloudflare “cloudflare.com”
Model opinion: looks like abuse (target: Ledger), confidence 70%. An opinion, not a finding.
brand in the name “revolut”lure words (login, verify, secure…) “helpdesk”
brand in the name “revolut”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
brand in the name “revolut”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+1 more
brand in the name “gmail”lure words (login, verify, secure…) “reward”brand name behind Cloudflare “cloudflare.com”
brand in the name “roblox”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more
Model opinion: unreachable when judged, confidence 80%. An opinion, not a finding.
brand in the name “schwab”brand name at a retail registrar “123-Reg Limited”form on a brand-styled page “has_form”
brand in the name “apple”lure words (login, verify, secure…) “login,secure”brand name on a rarely-seen nameserver “ndns.cn”
Model opinion: looks like abuse (target: Apple), confidence 80%. An opinion, not a finding.
brand in the name “barclays”lure words (login, verify, secure…) “service,services,update”identical page on many newborns “3767 identical pages”
Model opinion: looks like abuse (target: Barclays), confidence 80%. An opinion, not a finding.
brand in the name “shopify”brand name at a retail registrar “Namify Domains Inc”brand in page title, not in the name “cloudflare”
Model opinion: looks like abuse (target: Shopify), confidence 70%. An opinion, not a finding.
brand in the name “shopify”lure words (login, verify, secure…) “recover”
brand in the name “paypal”lure words (login, verify, secure…) “pay”brand name behind Cloudflare “cloudflare.com”
brand spelled with digits “sip777mobile→tmobile”brand plus digits “sip777mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand in the name “slack”brand name at a retail registrar “Name.com, Inc.”brand in page title, not in the name “ledger”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
brand in the name “starlink”brand plus digits “starlink101”brand name at a retail registrar “Network Solutions, LLC”identical page on many newborns “20 identical pages”
Model opinion: looks like abuse (target: Starlink), confidence 55%. An opinion, not a finding.
brand in the name “starlink”brand plus digits “starlink4dkiss”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
one-letter brand typo “sterling≈starling”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc.”brand name at a watch-list registrar “Dynadot Inc.”+1 more
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
one-letter brand typo “strip7≈stripe”brand plus digits “strip7”brand name on a rarely-seen nameserver “namepros-dns.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “stripe”TLD with a high abuse rate “bond”brand name on a rarely-seen nameserver “csof.net”brand name at a retail registrar “Dynadot Inc”+1 more
brand in the name “stripe”lure words (login, verify, secure…) “service,services”TLD with a high abuse rate “xyz”
brand in the name “ledger”lure words (login, verify, secure…) “portal,support”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CNOBIN INFORMATION TECHNOLOGY LIMITED”
brand in the name “trustwallet”lure words (login, verify, secure…) “support,wallet”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”
brand in the name “trezor”lure words (login, verify, secure…) “support”brand name at a retail registrar “Squarespace Domains II LLC”
brand in the name “icloud”lure words (login, verify, secure…) “support”brand name behind Cloudflare “cloudflare.com”
Model opinion: looks like abuse (target: Apple (iCloud)), confidence 80%. An opinion, not a finding.
brand in the name “taobao”lure words (login, verify, secure…) “pay”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “taobao”brand plus digits “taobao08”brand name at a retail registrar “DropCatch.com 1148 LLC”identical page on many newborns “145 identical pages”+1 more
Model opinion: looks like abuse (target: Taobao), confidence 55%. An opinion, not a finding.
brand in the name “icloud”very long name “31”brand plus digits “tarzanrockz12free456sevenicloud”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “telegram”lure words (login, verify, secure…) “auth”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “tesla”lure words (login, verify, secure…) “bonus”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”
brand in the name “tiktok”brand plus digits “tiktok18fun”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “tiktok”brand plus digits “tiktok988”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “tiktok”brand plus digits “tiktok99slot”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more