Flagged newborn domains, Sunday, October 25, 2026

129 names at tier medium or above in .xyz, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highbinancefleet.xyzscore 55echoes binance· empty page
brand in the name “binance”TLD with a high abuse rate “xyz”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “binance”

Model opinion: looks like abuse (target: Binance), confidence 62%. An opinion, not a finding.

Highu888v4.xyzscore 55echoes bbva· boilerplate page
brand spelled with digits “u888v4→bbva”brand plus digits “u888v4”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse, confidence 75%. An opinion, not a finding.

Highmisanthropic.xyzscore 52echoes anthropic· parked, for sale
brand in the name “anthropic”TLD with a high abuse rate “xyz”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Highnetflixtoto247.xyzscore 52echoes netflix· no DNS
brand in the name “netflix”brand plus digits “netflixtoto247”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”
Highsantanderusbank.xyzscore 52echoes santander· no DNS
brand in the name “santander”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Highcloud-static-cdn.xyzscore 50echoes icloud· active website
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”

Model opinion: suspicious, confidence 62%. An opinion, not a finding.

Highgggrooid-cloud.xyzscore 50echoes icloud· no web server
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Highgwe1.xyzscore 50· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Binance”brand in page title, not in the name “binance”

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Highkevinbnb.xyzscore 50· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Binance”brand in page title, not in the name “binance”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Highsupaterra.xyzscore 50· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

High731285.xyzscore 46· redirects elsewhere
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

High732285.xyzscore 46· redirects elsewhere
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

High732321.xyzscore 46· redirects elsewhere
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

High733321.xyzscore 46· redirects elsewhere
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

High735301.xyzscore 46· redirects elsewhere
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Highbtgifts-aus.xyzscore 46· blocked the probe
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Highcrystaldust.xyzscore 46· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 68%. An opinion, not a finding.

Highdoles5235.xyzscore 46· blocked the probe
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Highmailpicker.xyzscore 46· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highomeglevault.xyzscore 46· redirects elsewhere
TLD with a high abuse rate “xyz”brand in page title, not in the name “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 74%. An opinion, not a finding.

Highshanxian.xyzscore 46· redirects elsewhere
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 50%. An opinion, not a finding.

Highspotaclone.xyzscore 46· placeholder page
TLD with a high abuse rate “xyz”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Hightidewright.xyzscore 46· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “uniswap”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 66%. An opinion, not a finding.

Hightracerbot.xyzscore 46· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 65%. An opinion, not a finding.

Highverityagent.xyzscore 46· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highversuscraft.xyzscore 46· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 87%. An opinion, not a finding.

Highazalea-finance.xyzscore 44echoes binance· no DNS
one-letter brand typo “finance≈binance”TLD with a high abuse rate “xyz”brand name at a retail registrar “Name.com, Inc.”
Highex-media.xyzscore 44echoes expedia· not probed yet
one-letter brand typo “exmedia≈expedia”TLD with a high abuse rate “xyz”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
Mediumtakarapay.xyzscore 38· active website
TLD with a high abuse rate “xyz”page asks for credentials “Verify your identity”
Mediummaskot88m.xyzscore 36· blocked the probe
TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”brand in page title, not in the name “cloudflare”
punycode name “刘翔支持家驹四点就下次加上才继续加仓检 scripts=CJK”very long name “61”random-looking name “H=4.74”TLD with a high abuse rate “xyz”
punycode name “靠自己兄赐教世界第哦啊祭祀哦大家哦及促 scripts=CJK”very long name “61”random-looking name “H=4.74”TLD with a high abuse rate “xyz”
Mediumaaisahebonlineservices.xyzscore 34· active website
lure words (login, verify, secure…) “service,services”TLD with a high abuse rate “xyz”login form “has_form+login words”
Mediumx51yz24xbgeebfbsxbd7uu.xyzscore 33· server error
random-looking name “H=3.70”TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumxn--jlq49ia2230e.xyzscore 31· no DNS
punycode name “卡卡雷亚 scripts=CJK”random-looking name “H=3.66”TLD with a high abuse rate “xyz”
Medium1000xtrade.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Mediumaerodash.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Coinbase”
Mediumcatofduty.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Mediumcoaxer.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Mediumcompilercodes.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Mediumorloweb3.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”
Mediumrektknights.xyzscore 30· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Binance”
Mediumxn--fhqu4y0gz4exvotjhsyls74h.xyzscore 30· redirects elsewhere
punycode name “上海奶龙技术大学 scripts=CJK”very long name “28”TLD with a high abuse rate “xyz”
Medium110828.xyzscore 28· blocked the probe
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Medium33informatique.xyzscore 28· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”
Medium521015.xyzscore 28· server error
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumadapazariescortlari.xyzscore 28· active website
TLD with a high abuse rate “xyz”brand in page title, not in the name “whatsapp”
Mediumamorevero.xyzscore 28· other
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumapkpolo188asli.xyzscore 28· blocked the probe
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”
Mediumapkpolo188resmi.xyzscore 28· blocked the probe
TLD with a high abuse rate “xyz”brand in page title, not in the name “cloudflare”

Same data as JSON: /api/zone/risk?day=2026-10-25&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.