Flagged newborn domains, Sunday, October 25, 2026
6,557 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
TLD with a high abuse rate “bond”login form “has_form+login words”
page impersonates a brand “PayPal”
TLD with a high abuse rate “buzz”login form “has_form+login words”
TLD with a high abuse rate “rest”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “Coinbase”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “service,services”many hyphens “3”very long name “37”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
page impersonates a brand “PAYPAL”
page impersonates a brand “PayPal”
punycode name “외대부고총동문회 scripts=HANGUL”very long name “29”
punycode name “천안두정역푸르지오그랑피크 scripts=HANGUL”very long name “43”
punycode name “화성향남롯데캐슬시그니처 scripts=HANGUL”very long name “40”
punycode name “500añosdesancristobaldelascasas scripts=”very long name “31”
punycode name “양주회천중앙역파라곤 scripts=HANGUL”very long name “34”
punycode name “académieréussiteuniversitairemariefrance”very long name “40”
punycode name “검단센트레빌에듀시티모델하우스 scripts=HANGUL”very long name “49”
punycode name “검단센트레빌에듀시티 scripts=HANGUL”very long name “36”
punycode name “カケハシオキナワチャリティフェスティバル scripts=KATAKANA”very long name “39”
punycode name “educationartistiquefrançaise scripts=LAT”very long name “28”
punycode name “大年三十堆起的碳火 scripts=CJK”very long name “33”
punycode name “三益云健康管理中心 scripts=CJK”very long name “31”
punycode name “中国新能源汽车电商平台 scripts=CJK”very long name “39”
punycode name “中国餐饮电商平台 scripts=CJK”very long name “30”
punycode name “퍼스트공인중개사사무소 scripts=HANGUL”very long name “37”
punycode name “kulaçakirotoağirvasitaserkanusta scripts”very long name “32”
punycode name “معلمحجرواجهاتللتوريدوالتركيب scripts=ARA”very long name “39”
punycode name “ร้านผ่อนโทรศัพท์ scripts=THAI”very long name “29”
punycode name “창원책임누수설비 scripts=HANGUL”very long name “28”
punycode name “ນົກເພັນກວິນຍ່າງແບບຕະຫຼົກ scripts=LAO”very long name “43”
punycode name “sancristobaldelascasas500años scripts=LA”very long name “29”
punycode name “ລິງໂຕນັ້ນຊົນຕະຫຼອດທັງມື້ scripts=LAO”very long name “43”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “Apple ID”
page impersonates a brand “Apple ID”
page impersonates a brand “Apple ID”
page impersonates a brand “Apple ID”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “Binance”
random-looking name “H=4.33”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
random-looking name “H=3.64”TLD with a high abuse rate “icu”free DNS provider “dnsowl.com”
random-looking name “H=3.88”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
Same data as JSON: /api/zone/risk?day=2026-10-25&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.