Flagged newborn domains, Wednesday, October 28, 2026
2,183 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “นิวเหรียญชัยมินิแฟคตอรี่ให้เช่า scripts=”very long name “49”random-looking name “H=4.30”
punycode name “北京红星二锅头酒 scripts=CJK”very long name “29”random-looking name “H=4.24”
punycode name “北京红星二锅头酒 scripts=CJK”very long name “29”random-looking name “H=4.24”
punycode name “해남교육정보신문 scripts=HANGUL”very long name “30”random-looking name “H=4.04”
punycode name “학교폭력전문변호 scripts=HANGUL”very long name “30”random-looking name “H=3.99”
punycode name “더샵여주역더퍼스트 scripts=HANGUL”very long name “31”random-looking name “H=4.28”
punycode name “글로우메이크업스튜디오 scripts=HANGUL”very long name “39”random-looking name “H=4.28”
punycode name “美国男同理工学院 scripts=CJK”very long name “31”random-looking name “H=4.19”
punycode name “스테이블스케이트보드 scripts=HANGUL”very long name “35”random-looking name “H=4.21”
punycode name “재활상담복지센터양천 scripts=HANGUL”very long name “34”random-looking name “H=4.29”
punycode name “亚太地产都市华庭 scripts=CJK”very long name “29”random-looking name “H=4.11”
punycode name “ศูนย์ปรับสมดุลนนทบุรี scripts=THAI”very long name “35”random-looking name “H=4.14”
punycode name “爆破项目管理系统 scripts=CJK”very long name “29”random-looking name “H=4.16”
punycode name “生态健康商城服务商端口 scripts=CJK”very long name “38”random-looking name “H=4.05”
punycode name “珠港澳大桥马拉松 scripts=CJK”very long name “29”random-looking name “H=3.78”
punycode name “타이어뱅크남용인점 scripts=HANGUL”very long name “32”random-looking name “H=3.95”
punycode name “산방산어반아르떼 scripts=HANGUL”very long name “29”random-looking name “H=3.86”
punycode name “广西中烟工业有限责任公司 scripts=CJK”very long name “42”random-looking name “H=4.55”
punycode name “中国石油化工行业平台 scripts=CJK”very long name “35”random-looking name “H=4.32”
punycode name “广东南方财经全媒体集团股份有限公司 scripts=CJK”very long name “56”random-looking name “H=4.76”
punycode name “广东思创环境工程有限公司 scripts=CJK”very long name “41”random-looking name “H=4.32”
punycode name “마음디자인현장관리 scripts=HANGUL”very long name “31”random-looking name “H=4.35”
punycode name “천안아산역필하우스 scripts=HANGUL”very long name “31”random-looking name “H=3.82”
punycode name “박영선댄스아뜰리에 scripts=HANGUL”very long name “31”random-looking name “H=4.35”
lure words (login, verify, secure…) “account”brand in page title, not in the name “facebook”
lure words (login, verify, secure…) “service”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “alert,alerts,service”TLD with a high abuse rate “click”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “wordpress”
lure words (login, verify, secure…) “prize”brand in page title, not in the name “amazon”
lure words (login, verify, secure…) “customer,customers,service”TLD with a high abuse rate “cyou”
many hyphens “4”brand in page title, not in the name “wordpress”
many hyphens “3”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “confirm”brand in page title, not in the name “booking”
lure words (login, verify, secure…) “alert,alerts,prize”TLD with a high abuse rate “xyz”
lure words (login, verify, secure…) “alert,alerts”login form “has_form+login words”
lure words (login, verify, secure…) “official”brand in page title, not in the name “booking”
lure words (login, verify, secure…) “alert,alerts”login form “has_form+login words”
lure words (login, verify, secure…) “support”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “id”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “account”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “support”brand in page title, not in the name “whatsapp”
very long name “30”page impersonates a brand “IRS”
lure words (login, verify, secure…) “limited”brand in page title, not in the name “halifax”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “namecheap”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “wordpress”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “account,accounts,security”free DNS provider “dnsowl.com”
TLD with a high abuse rate “work”form on a brand-styled page “has_form”
lure words (login, verify, secure…) “customer”brand in page title, not in the name “booking”
lure words (login, verify, secure…) “service”brand in page title, not in the name “telegram”
Same data as JSON: /api/zone/risk?day=2026-10-28&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.