Flagged newborn domains, Friday, October 23, 2026
17,155 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “서울벳접속 scripts=HANGUL”random-looking name “H=3.85”
punycode name “쫌쫌따리 scripts=HANGUL”random-looking name “H=3.70”
punycode name “国立海龙大学 scripts=CJK”random-looking name “H=3.82”
punycode name “御辉国际 scripts=CJK”random-looking name “H=3.64”
punycode name “信瓷至诚瓷业 scripts=CJK”random-looking name “H=3.78”
punycode name “居民服务业 scripts=CJK”random-looking name “H=4.09”
punycode name “锦安实业 scripts=CJK”random-looking name “H=3.75”
punycode name “金陶瓷业 scripts=CJK”random-looking name “H=3.64”
punycode name “东升农业集团 scripts=CJK”random-looking name “H=3.79”
punycode name “柔云丝实业 scripts=CJK”random-looking name “H=4.00”
punycode name “海外就业 scripts=CJK”random-looking name “H=3.66”
punycode name “江口醇酒业 scripts=CJK”random-looking name “H=3.73”
punycode name “食品制造业 scripts=CJK”random-looking name “H=3.68”
punycode name “医药制造业 scripts=CJK”random-looking name “H=3.95”
punycode name “메랜대리마스터 scripts=HANGUL”random-looking name “H=3.71”
punycode name “西部煤炭供应商 scripts=CJK”random-looking name “H=4.33”
punycode name “苏宁购物 scripts=CJK”random-looking name “H=3.64”
punycode name “银蕨计划 scripts=CJK”random-looking name “H=3.77”
punycode name “서초반드레길 scripts=HANGUL”random-looking name “H=3.98”
punycode name “짱통신선불폰 scripts=HANGUL”random-looking name “H=3.63”
punycode name “潜江制药 scripts=CJK”random-looking name “H=3.62”
punycode name “东莞开大 scripts=CJK”random-looking name “H=3.64”
punycode name “东莞开放大学 scripts=CJK”random-looking name “H=4.11”
punycode name “甲东人防 scripts=CJK”random-looking name “H=3.64”
punycode name “宝华压缩机 scripts=CJK”random-looking name “H=3.97”
punycode name “奶介石大学 scripts=CJK”random-looking name “H=3.73”
punycode name “マイまくら店舗 scripts=CJK/HIRAGANA/KATAKANA”random-looking name “H=3.98”
punycode name “回头客超市 scripts=CJK”random-looking name “H=3.68”
punycode name “홈밸런스 scripts=HANGUL”random-looking name “H=3.91”
page impersonates a brand “IRS”
page impersonates a brand “Netflix”
TLD with a high abuse rate “cyou”login form “has_form+login words”
lure words (login, verify, secure…) “limited,service,services”very long name “37”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
page impersonates a brand “IRS”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “Coinbase”
brand in the name “amazon”brand plus digits “atlamazon380”
brand in the name “aramex”TLD with a high abuse rate “top”
page impersonates a brand “PayPal”
page impersonates a brand “Binance”
ambiguous brand word “apple”form on a brand-styled page “has_form”
page impersonates a brand “IRS”
page impersonates a brand “Coinbase”
page impersonates a brand “PayPal”
page impersonates a brand “Coinbase”
page impersonates a brand “Paypal”
Same data as JSON: /api/zone/risk?day=2026-10-23&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.