Flagged newborn domains, Thursday, October 29, 2026
9,579 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
lure words (login, verify, secure…) “login”many hyphens “3”TLD with a high abuse rate “click”page pushes urgent payment “Claim your bonus”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
many hyphens “3”TLD with a high abuse rate “xyz”brand in page title, not in the name “telegram”
page pushes urgent payment “act now”brand in page title, not in the name “wordpress”
ambiguous brand word “apple”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”brand name and brand-styled page “apple”
TLD with a high abuse rate “work”nameserver domain born the same day “clevelos.pro”
punycode name “행복한동행방문요양센터 scripts=HANGUL”very long name “36”random-looking name “H=4.42”form submits over plain HTTP “http://xn--2q1bv3lwuajxs0ndph1zb493bpsi2”
punycode name “학동트리플위너오피스텔 scripts=HANGUL”very long name “38”random-looking name “H=4.33”form submits over plain HTTP “http://xn--h50bk7c2whpwk8lemobd82bhtckuh”
lure words (login, verify, secure…) “recover,recovery”brand in page title, not in the name “whatsapp”
very long name “34”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “wordpress”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “wordpress”
lure words (login, verify, secure…) “official,update”brand in page title, not in the name “cloudflare”
very long name “29”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
brand in the name “disney”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “37 identical pages”
lure words (login, verify, secure…) “recover,recovery”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “google”
punycode name “教學設備 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “公式识别 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “icu”
punycode name “遞歸的雪國 scripts=CJK”random-looking name “H=3.95”TLD with a high abuse rate “top”
punycode name “國際旅游網 scripts=CJK”random-looking name “H=3.83”TLD with a high abuse rate “top”
punycode name “博華物流 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “鄉巴佬 scripts=CJK”random-looking name “H=3.70”TLD with a high abuse rate “top”
punycode name “綠色農產品網商 scripts=CJK”random-looking name “H=4.44”TLD with a high abuse rate “top”
punycode name “路虎攬胜 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “奶蛙健康學院 scripts=CJK”random-looking name “H=3.73”TLD with a high abuse rate “top”
punycode name “十九大魔王 scripts=CJK”random-looking name “H=3.83”TLD with a high abuse rate “top”
punycode name “教学设备 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “递归的雪国 scripts=CJK”random-looking name “H=3.62”TLD with a high abuse rate “top”
punycode name “国际旅游网 scripts=CJK”random-looking name “H=3.93”TLD with a high abuse rate “top”
punycode name “绿色农产品网商 scripts=CJK”random-looking name “H=4.18”TLD with a high abuse rate “top”
TLD with a high abuse rate “top”page impersonates a brand “Netflix”
brand in page title, not in the name “hostinger”identical page on many newborns “74 identical pages”
TLD with a high abuse rate “xyz”page impersonates a brand “Binance”
brand in page title, not in the name “hostinger”identical page on many newborns “74 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “74 identical pages”
brand in the name “americanexpress”
brand in page title, not in the name “hostinger”identical page on many newborns “74 identical pages”
TLD with a high abuse rate “homes”page impersonates a brand “Netflix”
many hyphens “4”very long name “40”brand in page title, not in the name “cloudflare”
many hyphens “6”very long name “48”brand in page title, not in the name “cloudflare”
many hyphens “6”very long name “48”brand in page title, not in the name “cloudflare”
Same data as JSON: /api/zone/risk?day=2026-10-29&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.