brand in the name “openai”brand plus digits “openai666”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
brand in the name “slack”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
brand in the name “starlink”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”identical page on many newborns “62 identical pages”
Model opinion: suspicious (target: Starlink), confidence 55%. An opinion, not a finding.
brand in the name “gmail”lure words (login, verify, secure…) “account,accounts”brand name at a retail registrar “Tucows Domains Inc.”
one-letter brand typo “whatssapp≈whatsapp”TLD with a high abuse rate “homes”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: WhatsApp), confidence 72%. An opinion, not a finding.
brand in the name “linkedin”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “linkedin”
Model opinion: looks benign, confidence 74%. An opinion, not a finding.
brand in the name “costco”brand name at a retail registrar “Tucows Domains Inc.”brand name and brand-styled page “costco”
Model opinion: looks like abuse (target: Costco), confidence 80%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “656gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Atom.com Domains LLC”
one-letter brand typo “leder≈ledger”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand in the name “telegram”TLD with a high abuse rate “icu”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
Model opinion: looks like abuse (target: Telegram), confidence 72%. An opinion, not a finding.
brand in the name “gmail”brand plus digits “bwanyajean20gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc”
brand in the name “usaa”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NicNames, Inc.”
brand in the name “spotify”brand plus digits “death2spotify”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
brand in the name “google”brand plus digits “google-koi-01”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “gmail”brand plus digits “jkrdlr918gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “ledger”brand plus digits “ledger-v2”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
brand in the name “usaa”TLD with a high abuse rate “bond”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NicNames, Inc.”
brand in the name “usaa”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NicNames, Inc.”
brand in the name “microsoft”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name redirects elsewhere “co.uk”
Model opinion: looks like abuse (target: Microsoft), confidence 82%. An opinion, not a finding.
brand in the name “roblox”TLD with a high abuse rate “cyou”brand name on a rarely-seen nameserver “nicnames.com”brand name at a retail registrar “NicNames, Inc.”
Model opinion: looks like abuse (target: Roblox), confidence 65%. An opinion, not a finding.
brand in the name “netflix”brand plus digits “netflixcasino1326”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “netflix”brand plus digits “netflixcasino1327”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “netflix”brand plus digits “netflixcasino1328”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “onedrive”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Network Solutions, LLC”brand name redirects elsewhere “youtube.com”
Model opinion: looks like abuse (target: Microsoft (OneDrive)), confidence 70%. An opinion, not a finding.
brand in the name “robinhood”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”
brand in the name “roblox”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Registrar.eu”
brand in the name “roblox”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
Model opinion: looks like phishing (target: Roblox), confidence 86%. An opinion, not a finding.
brand in the name “roblox”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Openprovider”
brand in the name “gmail”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “smbc”TLD with a high abuse rate “work”brand name at a retail registrar “Porkbun”brand name at a watch-list registrar “Porkbun”
one-letter brand typo “startling≈starling”TLD with a high abuse rate “work”brand name at a retail registrar “Squarespace Domains II LLC”brand name redirects elsewhere “startling.studio”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
Highstrip1.comscore 52echoes stripe· blocked the probe one-letter brand typo “strip1≈stripe”brand plus digits “strip1”brand name at a retail registrar “Domain Science Kutatasi Szolgaltato Korl”brand name redirects elsewhere “expireddomains.com”
brand in the name “taobao”brand plus digits “taobao0539”brand name at a retail registrar “Gname 224 Inc”brand name at a watch-list registrar “Gname 224 Inc”
brand in the name “tiktok”TLD with a high abuse rate “work”brand name at a retail registrar “Porkbun”brand name at a watch-list registrar “Porkbun”
brand in the name “tiktok”brand plus digits “tiktokcdn-1sgaws”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
Model opinion: looks like abuse (target: TikTok), confidence 72%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “tiktokcdn-2sgaws”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “tiktok”brand plus digits “tiktokcdn-3sgaws”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
Model opinion: looks like abuse (target: TikTok), confidence 77%. An opinion, not a finding.
brand in the name “tiktok”brand plus digits “tiktokcdn-4sgaws”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
Model opinion: looks like abuse (target: TikTok), confidence 75%. An opinion, not a finding.
brand in the name “tiktok”TLD with a high abuse rate “xyz”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
brand in the name “tiktok”TLD with a high abuse rate “cyou”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
Model opinion: looks like abuse (target: TikTok), confidence 80%. An opinion, not a finding.
brand in the name “usps”brand plus digits “usps2”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand spelled with digits “8bv4hua1eiyq→bbva”brand plus digits “8bv4hua1eiyq”brand name at a retail registrar “Name.com, Inc.”
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “roblox”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “roblox”
Model opinion: looks like abuse (target: Roblox), confidence 70%. An opinion, not a finding.
brand spelled with digits “row27mobile→tmobile”brand plus digits “row27mobile”brand name at a retail registrar “Realtime Register B.V.”
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “roblox”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
brand in the name “wechat”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “wechat”
Model opinion: looks like abuse (target: WeChat), confidence 70%. An opinion, not a finding.
TLD with a high abuse rate “lol”page impersonates a brand “Binance”brand in page title, not in the name “binance”
Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.
one-letter brand typo “cloud≈icloud”brand plus digits “4k-cloud-pro”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand plus digits “69vn-mobile”TLD with a high abuse rate “homes”brand name behind Cloudflare “cloudflare.com”