Flagged newborn domains, Tuesday, October 27, 2026
9,671 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
TLD with a high abuse rate “click”nameserver domain born the same day “growwelladvisorsonline.click”
TLD with a high abuse rate “click”nameserver domain born the same day “growwelladvisorsonline.click”
TLD with a high abuse rate “click”nameserver domain born the same day “growwelladvisorsonline.click”
TLD with a high abuse rate “click”nameserver domain born the same day “growwelladvisorsonline.click”
TLD with a high abuse rate “click”nameserver domain born the same day “growwelladvisorsonline.click”
punycode name “윤선생영어숲묵동학원 scripts=HANGUL”very long name “34”random-looking name “H=4.39”form submits over plain HTTP “http://xn--2q1bo3ld2ewhi1c6xknpa25cnvz05”
punycode name “더이앤뷰티클리닉센터 scripts=HANGUL”very long name “34”random-looking name “H=4.18”form submits over plain HTTP “http://xn--bj1b8jm6n1yewyekvhu1dyuxprb43”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
brand in the name “zelle”form on a brand-styled page “has_form”
very long name “57”TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “airbnb”
brand in the name “revolut”form on a brand-styled page “has_form”
punycode name “id社区 scripts=CJK/LATIN”lure words (login, verify, secure…) “id”TLD with a high abuse rate “fun”
punycode name “双购阁 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--jor484kzsf.top/”
brand in the name “chatgpt”very long name “43”brand plus digits “httpsnexo-dev-jeremygenialwood17chatgpts”random-looking name “H=4.19”
punycode name “許愿資源庫 scripts=CJK”random-looking name “H=3.95”TLD with a high abuse rate “top”
punycode name “相随集团 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “xyz”
punycode name “맞춤학원 scripts=HANGUL”random-looking name “H=3.64”TLD with a high abuse rate “bond”
punycode name “科创学社 scripts=CJK”random-looking name “H=3.66”TLD with a high abuse rate “work”
punycode name “國際奶蛙大學 scripts=CJK”random-looking name “H=3.78”TLD with a high abuse rate “top”
punycode name “北奶建筑大学 scripts=CJK”random-looking name “H=3.92”TLD with a high abuse rate “icu”
punycode name “许愿资源库 scripts=CJK”random-looking name “H=3.73”TLD with a high abuse rate “top”
punycode name “專升本上岸 scripts=CJK”random-looking name “H=3.95”TLD with a high abuse rate “top”
punycode name “专升本上岸 scripts=CJK”random-looking name “H=3.85”TLD with a high abuse rate “top”
punycode name “赢微人彘被质押 scripts=CJK”random-looking name “H=4.13”TLD with a high abuse rate “icu”
punycode name “白菜批發市場 scripts=CJK”random-looking name “H=3.78”TLD with a high abuse rate “top”
punycode name “国际奶蛙大学 scripts=CJK”random-looking name “H=3.92”TLD with a high abuse rate “top”
TLD with a high abuse rate “fun”page impersonates a brand “Office 365”
TLD with a high abuse rate “top”page impersonates a brand “Binance”
brand in page title, not in the name “hostinger”identical page on many newborns “58 identical pages”
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”page pushes urgent payment “LIMITED TIME OFFER”
brand in page title, not in the name “hostinger”identical page on many newborns “58 identical pages”
page asks for credentials “Sign in to your account”
TLD with a high abuse rate “fun”page impersonates a brand “Binance”
brand in page title, not in the name “hostinger”identical page on many newborns “58 identical pages”
TLD with a high abuse rate “work”free DNS provider “dnsowl.com”login form “has_form+login words”
brand in page title, not in the name “hostinger”identical page on many newborns “58 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “58 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “58 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “58 identical pages”
many hyphens “4”very long name “37”brand in page title, not in the name “cloudflare”
many hyphens “6”very long name “48”brand in page title, not in the name “cloudflare”
many hyphens “4”very long name “36”brand in page title, not in the name “cloudflare”
many hyphens “5”very long name “48”brand in page title, not in the name “cloudflare”
many hyphens “4”very long name “38”brand in page title, not in the name “cloudflare”
many hyphens “4”very long name “40”brand in page title, not in the name “cloudflare”
many hyphens “6”very long name “48”brand in page title, not in the name “cloudflare”
many hyphens “4”very long name “45”brand in page title, not in the name “cloudflare”
Same data as JSON: /api/zone/risk?day=2026-10-27&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.