Flagged newborn domains, Monday, October 26, 2026

26 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalplaystati0n.proscore 89echoes playstation· active website
brand spelled with digits “playstati0n→playstation”brand plus digits “playstati0n”free DNS provider “dnsowl.com”brand in page title, not in the name “playstation”+1 more

Model opinion: looks like phishing (target: Sony PlayStation), confidence 90%. An opinion, not a finding.

Criticalitau-30horas.clickscore 79echoes itau· active website
brand in the name “itau”brand plus digits “itau-30horas”TLD with a high abuse rate “click”brand name and brand-styled page “itau”+1 more

Model opinion: looks like abuse (target: Itaú), confidence 80%. An opinion, not a finding.

Criticaluniswapv4.xyzscore 79echoes uniswap· active website
brand in the name “uniswap”brand plus digits “uniswapv4”TLD with a high abuse rate “xyz”brand name and brand-styled page “uniswap”+1 more

Model opinion: looks like a scam (target: Uniswap), confidence 62%. An opinion, not a finding.

Criticalbronzereborn.xyzscore 76· active website
TLD with a high abuse rate “xyz”page asks for credentials “Verify your account”brand in page title, not in the name “roblox”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalshiptracking.infoscore 72· active website
lure words (login, verify, secure…) “track,tracking”page impersonates a brand “USPS”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalrobloxintegrity.xyzscore 71echoes roblox· active website
brand in the name “roblox”TLD with a high abuse rate “xyz”brand name and brand-styled page “roblox”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Roblox), confidence 55%. An opinion, not a finding.

Criticalstarlinkly.onlinescore 69echoes starlink· active website
brand in the name “starlink”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “starlink”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaltiktokphotodownloader.comscore 69echoes tiktok· active website
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: TikTok), confidence 55%. An opinion, not a finding.

Criticalbigbos99-mobile.questscore 68echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “bigbos99-mobile”TLD with a high abuse rate “quest”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalbigbos99-mobile.restscore 68echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “bigbos99-mobile”TLD with a high abuse rate “rest”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalbigbos99-mobile.sbsscore 68echoes tmobile· active website
one-letter brand typo “mobile≈tmobile”brand plus digits “bigbos99-mobile”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalboltbook.funscore 68· active website
TLD with a high abuse rate “fun”page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticalwhypaywhenfree.lolscore 68· active website
TLD with a high abuse rate “lol”page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalbinance-t.comscore 67echoes binance· active website
brand in the name “binance”page impersonates a brand “Binance”brand name and brand-styled page “binance”

Model opinion: looks like phishing (target: Binance), confidence 86%. An opinion, not a finding.

Criticalapple-1ds.xyzscore 64echoes apple· active website
brand in the name “apple”brand plus digits “apple-1ds”TLD with a high abuse rate “xyz”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Apple), confidence 72%. An opinion, not a finding.

Criticalfin-ance.onlinescore 60echoes binance· active website
one-letter brand typo “finance≈binance”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticaljoecoffeecompanybeans.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Joe Coffee Company), confidence 80%. An opinion, not a finding.

Criticalkeychronhardware.shopscore 60· active website
page impersonates a brand “DHL”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Keychron), confidence 80%. An opinion, not a finding.

Criticalmouselectronics.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Mous), confidence 80%. An opinion, not a finding.

Criticalmousphone.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Mous), confidence 77%. An opinion, not a finding.

Criticalprinero.storescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “shopify”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalpropeyhub.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “shopify”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalstampsgeneral.shopscore 60· active website
page impersonates a brand “USPS”brand in page title, not in the name “usps”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 82%. An opinion, not a finding.

Criticalteamguess.appscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticaltracr.techscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalxbtcpool.orgscore 60· active website
page impersonates a brand “coinbase”brand in page title, not in the name “coinbase”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 78%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-10-26&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.