Flagged newborn domains, Wednesday, October 28, 2026
9,368 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “Microsoft 365”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “IRS”
page impersonates a brand “PayPal”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “update”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
page impersonates a brand “USPS”
page impersonates a brand “Coinbase”
page impersonates a brand “USPs”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “secure,service,services”very long name “33”
page impersonates a brand “Office 365”
TLD with a high abuse rate “top”login form “has_form+login words”
punycode name “ทางเข้าเลขมหาชน scripts=THAI”very long name “28”
punycode name “บริษัทขนส่งสินค้า scripts=THAI”very long name “31”
punycode name “교통사고전문변호 scripts=HANGUL”very long name “29”
punycode name “롯데캐슬르웨스트마곡 scripts=HANGUL”very long name “35”
punycode name “优质蜂蜜溯源电商 scripts=CJK”very long name “30”
punycode name “당신의근처도매몰 scripts=HANGUL”very long name “30”
punycode name “นิวเหรียญชัยโรงงานสําเร็จรูปให้เช่า scri”very long name “58”
punycode name “รับซื้อเศษทองแดง scripts=THAI”very long name “31”
punycode name “서울맥치과강서점 scripts=HANGUL”very long name “29”
punycode name “강남아동발달센터 scripts=HANGUL”very long name “30”
punycode name “akdoğansporkulübütaekwondokickboks scrip”very long name “34”
punycode name “검단호반다드림부동산 scripts=HANGUL”very long name “35”
punycode name “desguacedevehículosyrecogida scripts=LAT”very long name “28”
punycode name “中国商用飞机有限责任公司 scripts=CJK”very long name “42”
punycode name “中國石油化工行業平台 scripts=CJK”very long name “37”
punycode name “中关村供应链金融 scripts=CJK”very long name “29”
punycode name “中关村供应链金融服务平台 scripts=CJK”very long name “44”
punycode name “화서역호수공원아너스빌 scripts=HANGUL”very long name “39”
punycode name “공기수비대습식베이크아웃 scripts=HANGUL”very long name “40”
punycode name “위풍댕댕의기냥냥 scripts=HANGUL”very long name “28”
punycode name “parroquiachárbelbarranquilla scripts=LAT”very long name “28”
punycode name “praxisfürpsychotherapieesmaaktürk script”very long name “33”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “IRS”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
random-looking name “H=4.06”TLD with a high abuse rate “cfd”free DNS provider “dnsowl.com”
brand in page title, not in the name “telegram”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “cloudflare”
brand in page title, not in the name “instagram”
brand in page title, not in the name “namecheap”
Same data as JSON: /api/zone/risk?day=2026-10-28&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.