Flagged newborn domains, Thursday, October 29, 2026

9,579 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalnetflixproducts.shopscore 85echoes netflix· active website
brand in the name “netflix”page impersonates a brand “Netflix”brand name and brand-styled page “netflix”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Netflix), confidence 90%. An opinion, not a finding.

Criticalcasinopaypal.topscore 81echoes paypal· active website
brand in the name “paypal”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Paypal”+1 more

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalfront-krovavoj-blokady-lordfilm.cfdscore 78· active website
many hyphens “3”very long name “31”TLD with a high abuse rate “cfd”page impersonates a brand “Netflix”+2 more

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalaigene.funscore 68· active website
TLD with a high abuse rate “fun”page impersonates a brand “Coinbase”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalchatdesk.menscore 68· active website
TLD with a high abuse rate “men”page impersonates a brand “PayPal”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticaldayinthelife.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Criticalfletchtrade.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “MetaMask”brand in page title, not in the name “robinhood”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalmp4w.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 93%. An opinion, not a finding.

Criticalzoloft4world.topscore 68· active website
TLD with a high abuse rate “top”page impersonates a brand “MetaMask”brand in page title, not in the name “metamask”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalstarlink-iptv-4k.cloudscore 67echoes starlink· active website
brand in the name “starlink”brand plus digits “starlink-iptv-4k”brand name at a retail registrar “Dynadot, LLC”brand name at a watch-list registrar “Dynadot, LLC”+1 more

Model opinion: looks like abuse, confidence 86%. An opinion, not a finding.

Criticalvanguard-tv-4k.cloudscore 67echoes vanguard· active website
brand in the name “vanguard”brand plus digits “vanguard-tv-4k”brand name at a retail registrar “Dynadot, LLC”brand name at a watch-list registrar “Dynadot, LLC”+1 more

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Critical9icloud.restscore 66echoes icloud· active website
brand in the name “icloud”brand plus digits “9icloud”TLD with a high abuse rate “rest”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: looks like abuse (target: Apple), confidence 72%. An opinion, not a finding.

Criticalcostc.shopscore 66echoes costco· active website
one-letter brand typo “costc≈costco”brand in page title, not in the name “costco”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Costco), confidence 93%. An opinion, not a finding.

Criticalcyclelimitedcycling.shopscore 66· active website
lure words (login, verify, secure…) “limited”page impersonates a brand “PayPal”brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 80%. An opinion, not a finding.

Criticalsparkasse-tan-de.topscore 66echoes sparkasse· active website
brand in the name “sparkasse”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “darkhost.pro”page impersonates a brand “DHL”

Model opinion: looks like phishing (target: DHL), confidence 95%. An opinion, not a finding.

Criticalnubankslotscasino.comscore 65echoes nubank· active website
brand in the name “nubank”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “DEVEXPANSE LTD d/b/a Regery.com”brand name at a watch-list registrar “DEVEXPANSE LTD d/b/a Regery.com”+1 more

Model opinion: looks like abuse (target: Nubank), confidence 77%. An opinion, not a finding.

Criticaltrez0r-suite.sitescore 63echoes trezor· active website
brand spelled with digits “trez0r-suite→trezor”brand plus digits “trez0r-suite”brand in page title, not in the name “trezor”

Model opinion: suspicious (target: trezor), confidence 41%. An opinion, not a finding.

Criticalvanguardjustice.blogscore 63echoes vanguard· active website
brand in the name “vanguard”brand name and brand-styled page “vanguard”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 85%. An opinion, not a finding.

Criticalnettlebay.cfdscore 62echoes ebay· active website
brand in the name “ebay”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalanhaenger.koelnscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalapizie.techscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalaquahunaaquarium.shopscore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.

Criticalaquahunatropical.shopscore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 74%. An opinion, not a finding.

Criticalbakethecookieshoppebakes.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “nationwide”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Bake the Cookie Shoppe), confidence 62%. An opinion, not a finding.

Criticalchassis.livescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalcloudharbour.techscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalcounter-strike.partyscore 60echoes stripe· active website
one-letter brand typo “strike≈stripe”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Valve (Counter-Strike)), confidence 60%. An opinion, not a finding.

Criticalcoverwatch.appscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalcrmdirect.topscore 60· active website
TLD with a high abuse rate “top”free DNS provider “dnsowl.com”page asks for credentials “Sign in to your account”login form “has_form+login words”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalctlcomputing.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “google”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: CTL), confidence 68%. An opinion, not a finding.

Criticaldeal-schmiede.comscore 60· active website
page impersonates a brand “DHL”brand in page title, not in the name “ebay”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticaldexascanfitness.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 60%. An opinion, not a finding.

Criticaldexascanwellness.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 68%. An opinion, not a finding.

Criticaleuronaut.appscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalgabostore.latscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Criticalharborline.ltdscore 60· active website
page impersonates a brand “USPS”brand in page title, not in the name “usps”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalhumanmail.worldscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalinboxshare.appscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 85%. An opinion, not a finding.

Criticalindustriefashion.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Industrie), confidence 75%. An opinion, not a finding.

Criticalindustriewear.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Industrie Clothing), confidence 80%. An opinion, not a finding.

Criticalkarmaqueens.spacescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalkokotv.shopscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalmafiacoin.sitescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: PayPal), confidence 85%. An opinion, not a finding.

Criticalmegapass.storescore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalphilosophyhome.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “outlook”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Philosophy), confidence 85%. An opinion, not a finding.

Criticalsexdollspleasure.shopscore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalspeckcases.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Speck Products), confidence 80%. An opinion, not a finding.

Criticalspeckelectronics.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “apple”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Speck Products), confidence 70%. An opinion, not a finding.

Criticalsubpk.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalsupcasedevices.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “nintendo”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: SUPCASE), confidence 70%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-10-29&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.