Flagged newborn domains, Tuesday, October 27, 2026

9,671 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalmafiaonrobinhood.lolscore 98echoes robinhood· active website
brand in the name “robinhood”TLD with a high abuse rate “lol”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”+1 more

Model opinion: looks like a scam, confidence 82%. An opinion, not a finding.

Criticalmaratonamicrosoft365.cloudscore 77echoes microsoft· active website
brand in the name “microsoft”brand plus digits “maratonamicrosoft365”page impersonates a brand “Microsoft 365”brand name and brand-styled page “microsoft”+1 more

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalopenai-japan.topscore 77echoes openai· active website
brand in the name “openai”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “openai”+1 more

Model opinion: looks like phishing (target: GMO Click Securities), confidence 82%. An opinion, not a finding.

Criticalsevelune-finance-fr.topscore 74echoes binance· active website
one-letter brand typo “finance≈binance”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+2 more

Model opinion: looks like a scam, confidence 90%. An opinion, not a finding.

Criticalcoke-cloud.bestscore 70echoes icloud· active website
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalxboxonegaoqingbofangtuijian2.babyscore 70echoes xbox· active website
brand in the name “xbox”very long name “28”brand plus digits “xboxonegaoqingbofangtuijian2”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalstarlink-global.orgscore 69echoes starlink· active website
brand in the name “starlink”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “starlink”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Starlink), confidence 60%. An opinion, not a finding.

Criticaltupuedesvenderenamazon.blogscore 69echoes amazon· active website
brand in the name “amazon”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalagentka.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalflapagent.funscore 68· active website
TLD with a high abuse rate “fun”page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaljustpanel.orgscore 66· active website
page asks for credentials “log in to your account”page impersonates a brand “PayPal”login form “has_form+login words”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalrobloxgame.wikiscore 65echoes roblox· active website
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticaltelegramgrowthsolution.proscore 65echoes telegram· active website
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalhuluapparel.shopscore 63echoes hulu· active website
brand in the name “hulu”brand name and brand-styled page “hulu”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Hulu), confidence 85%. An opinion, not a finding.

Criticaltiktokbaixarclip.sitescore 63echoes tiktok· active website
brand in the name “tiktok”brand name and brand-styled page “tiktok”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: TikTok), confidence 60%. An opinion, not a finding.

Criticalvanguardinitiatives.orgscore 63echoes vanguard· active website
brand in the name “vanguard”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalbestbuyse.shopscore 62echoes bestbuy· active website
brand in the name “bestbuy”brand name at a retail registrar “Namecheap, Inc.”brand name at a watch-list registrar “Namecheap, Inc.”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Best Buy), confidence 80%. An opinion, not a finding.

Criticalgooglewalletsextension.livescore 62echoes google· active website
brand in the name “google”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like phishing (target: Google Chrome Web Store), confidence 88%. An opinion, not a finding.

Criticalitauprotegeotorcedor.xyzscore 62echoes itau· active website
brand in the name “itau”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Itaú Unibanco), confidence 75%. An opinion, not a finding.

Criticalxbox360gaoqingshipinxianb.babyscore 62echoes xbox· active website
brand in the name “xbox”brand plus digits “xbox360gaoqingshipinxianb”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Critical1hdhub4u.beerscore 60· active website
page impersonates a brand “netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 90%. An opinion, not a finding.

Criticalaknovatech.worldscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalashworthblades.storescore 60· active website
page impersonates a brand “USPS”brand in page title, not in the name “usps”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 70%. An opinion, not a finding.

Criticalbecausewellness.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Because Market), confidence 62%. An opinion, not a finding.

Criticalctltech.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: CTL), confidence 60%. An opinion, not a finding.

Criticalcutehartmakeup.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “tiktok”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticaldebride.globalscore 60· active website
page impersonates a brand “USPS”brand in page title, not in the name “usps”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 66%. An opinion, not a finding.

Criticalfascinationsworks.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Fascinations), confidence 70%. An opinion, not a finding.

Criticaljualbacklink.comscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalkeychrondevices.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Keychron), confidence 85%. An opinion, not a finding.

Criticallain-cloud.xyzscore 60echoes icloud· active website
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticallecartomantidegliangeli.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalmacry.orgscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 82%. An opinion, not a finding.

Criticalmagbakmobile.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “tesla”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: MagBak), confidence 74%. An opinion, not a finding.

Criticalmorqueli.digitalscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticalmoushardware.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Mous), confidence 82%. An opinion, not a finding.

Criticalottocasttech.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Ottocast), confidence 82%. An opinion, not a finding.

Criticalsirapparel.shopscore 60· active website
page impersonates a brand “Paypal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: SIR. (SIR the label)), confidence 75%. An opinion, not a finding.

Criticalstampsmerch.shopscore 60· active website
page impersonates a brand “USPS”brand in page title, not in the name “usps”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticaltauricase.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: TAURI), confidence 60%. An opinion, not a finding.

Criticalthegreenhouseinterior.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticaltiktck.sitescore 60echoes tiktok· active website
one-letter brand typo “tiktck≈tiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: TikTok), confidence 70%. An opinion, not a finding.

Criticalusingapps.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highanthropic-ant.onlinescore 59echoes anthropic· active website
brand in the name “anthropic”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “anthropic”

Model opinion: looks like a scam (target: Anthropic), confidence 85%. An opinion, not a finding.

Highanthropicant.worldscore 59echoes anthropic· active website
brand in the name “anthropic”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “anthropic”

Model opinion: looks like a scam (target: Anthropic), confidence 80%. An opinion, not a finding.

Highanthropicipo.vipscore 59echoes anthropic· active website
brand in the name “anthropic”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “anthropic”

Model opinion: looks like a scam (target: Anthropic), confidence 86%. An opinion, not a finding.

Highopenseais.proscore 59echoes opensea· active website
brand in the name “opensea”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”brand name and brand-styled page “opensea”

Model opinion: looks like phishing (target: OpenSea), confidence 93%. An opinion, not a finding.

Hightiktokvideodownloader.onlinescore 59echoes tiktok· active website
brand in the name “tiktok”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”brand name and brand-styled page “tiktok”

Model opinion: looks like abuse (target: TikTok), confidence 62%. An opinion, not a finding.

Highanthropiceth.funscore 58echoes anthropic· active website
brand in the name “anthropic”TLD with a high abuse rate “fun”brand in page title, not in the name “robinhood”

Model opinion: looks like a scam (target: Anthropic), confidence 85%. An opinion, not a finding.

Highcoinly.buzzscore 58· active website
TLD with a high abuse rate “buzz”free DNS provider “dnsowl.com”page impersonates a brand “Binance”brand in page title, not in the name “google”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-10-27&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.