Flagged newborn domains, Friday, October 23, 2026

2,480 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Mediumxys8.makeupscore 28· blocked the probe
TLD with a high abuse rate “makeup”brand in page title, not in the name “cloudflare”
Mediumxywbzz.topscore 28· active website
TLD with a high abuse rate “top”brand in page title, not in the name “openai”
Mediumyanbar.xyzscore 28· server error
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumyannbang.camscore 28· active website
TLD with a high abuse rate “cam”brand in page title, not in the name “namecheap”
Mediumyjtt6.homesscore 28· blocked the probe
TLD with a high abuse rate “homes”brand in page title, not in the name “cloudflare”
Mediumyuntengxin.icuscore 28· active website
TLD with a high abuse rate “icu”brand in page title, not in the name “steam”
Mediumzatt9.beautyscore 28· blocked the probe
TLD with a high abuse rate “beauty”brand in page title, not in the name “cloudflare”
Mediumzcc2zonghoutai2.topscore 28· blocked the probe
TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”
Mediumzelvornis-emeraldforest.clickscore 28· blocked the probe
TLD with a high abuse rate “click”brand in page title, not in the name “cloudflare”
Mediumzhumail.xyzscore 28· empty page
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumzm2proof1022.clickscore 28· active website
TLD with a high abuse rate “click”brand in page title, not in the name “wordpress”
Mediumzssp6.workscore 28· blocked the probe
TLD with a high abuse rate “work”brand in page title, not in the name “cloudflare”
Mediumzsymax.icuscore 28· server error
TLD with a high abuse rate “icu”brand in page title, not in the name “cloudflare”
Mediumzuneareli.comscore 28· other
free DNS provider “dnsowl.com”brand in page title, not in the name “cloudflare”
Mediumzx822.sbsscore 28· blocked the probe
TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
punycode name “ทางเข้าหวยอินทรีย์ scripts=THAI”very long name “34”random-looking name “H=3.77”
punycode name “용인동문디이스트 scripts=HANGUL”very long name “28”random-looking name “H=4.10”
punycode name “湖南再生资源回收 scripts=CJK”very long name “30”random-looking name “H=4.25”
punycode name “稀土集团国际官网 scripts=CJK”very long name “28”random-looking name “H=3.83”
Mediumxn--68jtjg5a0db4g3gua9859ety9avr6h.tokyoscore 27· boilerplate page
punycode name “引越し侍キャッシュバック scripts=CJK/HIRAGANA/KATAKA”very long name “34”random-looking name “H=4.24”
punycode name “ติดตั้งประตูรีโมท scripts=THAI”very long name “30”random-looking name “H=3.97”
punycode name “เว็บสล็อตทดลองเล่น scripts=THAI”very long name “31”random-looking name “H=4.12”
punycode name “바흐하임타운하우스 scripts=HANGUL”very long name “32”random-looking name “H=4.16”
Mediumxn--9m1by4fm7lca1zi7v42qjsbwxfbwqmna.shopscore 27· active website
punycode name “힐스테이트시흥더클래스 scripts=HANGUL”very long name “36”random-looking name “H=4.28”
Mediumxn--ccksm9g1ek6lvcb7421i5gzady0j.tokyoscore 27· boilerplate page
punycode name “専門書アカデミークーポン scripts=CJK/KATAKANA/KATAKA”very long name “32”random-looking name “H=4.55”
punycode name “ティックトックフォロワー購入 scripts=CJK/KATAKANA/KATA”very long name “32”random-looking name “H=4.37”
Mediumxn--dcknq1bc0aw4etcwc5e0ctfh1il7li.tokyoscore 27· boilerplate page
punycode name “レゾナンスバーチャルオフィスクーポン scripts=KATAKANA/KATA”very long name “34”random-looking name “H=4.14”
punycode name “上海春长自动化设备有限公司 scripts=CJK”very long name “44”random-looking name “H=4.46”
punycode name “두산위브시그니처광양 scripts=HANGUL”very long name “34”random-looking name “H=4.24”
Mediumxn--hl0bk9gg2dbuc99a12kqofz2kxlreyo.sitescore 27· empty page
punycode name “청라더리브티아모까사 scripts=HANGUL”very long name “35”random-looking name “H=4.31”
punycode name “冠御科技工程行 scripts=CJK”very long name “28”random-looking name “H=3.87”
Mediumxn--nckfj4c5ei7b6d5gfb7he5538jj1uj.tokyoscore 27· boilerplate page
punycode name “ダビングコピー革命キャンペーン scripts=CJK/KATAKANA/KAT”very long name “34”random-looking name “H=4.12”
Mediumxn--nckmqa8ebj8k8c1hb1ic4106jok5h.tokyoscore 27· boilerplate page
punycode name “ストスト買取キャンペーンコード scripts=CJK/KATAKANA/KAT”very long name “33”random-looking name “H=4.08”
punycode name “베트남현지촬영코디 scripts=HANGUL”very long name “32”random-looking name “H=4.57”
Mediumxn--sn3bu1e90fosb91eda847oi7e.comscore 27· boilerplate page
punycode name “본사직영홈페이지 scripts=HANGUL”very long name “29”random-looking name “H=4.06”
Mediumxn--t8j0a2tla0he4ai1i6frcyg9e6976l.tokyoscore 27· boilerplate page
punycode name “グランツキャットフードお試し scripts=CJK/HIRAGANA/KATA”very long name “34”random-looking name “H=4.33”
punycode name “과천청사역한양수자인 scripts=HANGUL”very long name “35”random-looking name “H=4.25”
punycode name “深圳市硅谷动力产业园运营有限公司 scripts=CJK”very long name “53”random-looking name “H=4.56”
Mediumxn--vhqqb4yp4b8zstwomfvynj0i3a.comscore 27· no DNS
punycode name “中国物流信息产业网 scripts=CJK”very long name “30”random-looking name “H=4.38”
Mediumxn--w8j6ctctjf5nqitczd6211be1lll4io0xc.tokyoscore 27· boilerplate page
punycode name “京都きもの友禅クリーニング scripts=CJK/HIRAGANA/KATAK”very long name “38”random-looking name “H=4.27”
Mediumxn--xckd4at1mva3355gfqkry0cc08a.sitescore 27· boilerplate page
punycode name “ストラッシュ脱毛料金 scripts=CJK/KATAKANA”very long name “31”random-looking name “H=4.19”
Medium0nlinesecure.infoscore 26· blocked the probe
lure words (login, verify, secure…) “secure”brand in page title, not in the name “cloudflare”
Mediumacimasupport.onlinescore 26· blocked the probe
lure words (login, verify, secure…) “support”brand in page title, not in the name “cloudflare”
Mediumalertribuna.techscore 26· active website
lure words (login, verify, secure…) “alert”brand in page title, not in the name “telegram”
Mediumballsecurity.orgscore 26· placeholder page
lure words (login, verify, secure…) “security”brand in page title, not in the name “wordpress”
Mediumbonus.contactscore 26· server error
lure words (login, verify, secure…) “bonus”brand in page title, not in the name “cloudflare”
Mediumcheckout-dmv-gov.sitescore 26· empty page
lure words (login, verify, secure…) “gov”brand in page title, not in the name “telegram”
Mediumcustomersportal.xyzscore 26· not probed yet
lure words (login, verify, secure…) “customer,customers,portal”TLD with a high abuse rate “xyz”
Mediumdelivery-fees.irishscore 26· blocked the probe
lure words (login, verify, secure…) “delivery”brand in page title, not in the name “cloudflare”
Mediumdeliveryrewards.xyzscore 26· not probed yet
lure words (login, verify, secure…) “delivery,reward,rewards”TLD with a high abuse rate “xyz”

Same data as JSON: /api/zone/risk?day=2026-10-23&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.