Flagged newborn domains, Friday, October 30, 2026
2,658 names at tier medium or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
lure words (login, verify, secure…) “delivery”brand in page title, not in the name “nationwide”
lure words (login, verify, secure…) “reward”brand in page title, not in the name “paypal”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “member”brand in page title, not in the name “booking”
lure words (login, verify, secure…) “wallet”brand in page title, not in the name “telegram”
very long name “28”page impersonates a brand “PayPal”
lure words (login, verify, secure…) “portal”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “secure”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services,support”lure suffix “servicesupportcentre”
lure words (login, verify, secure…) “support”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “support”brand in page title, not in the name “hubspot”
lure words (login, verify, secure…) “wallet”brand in page title, not in the name “apple”
many hyphens “3”brand in page title, not in the name “roblox”
lure words (login, verify, secure…) “track”brand in page title, not in the name “google”
punycode name “婭 scripts=CJK”TLD with a high abuse rate “top”
punycode name “鍎 scripts=CJK”TLD with a high abuse rate “top”
punycode name “娅 scripts=CJK”TLD with a high abuse rate “top”
punycode name “聰 scripts=CJK”TLD with a high abuse rate “top”
punycode name “모카고띠 scripts=HANGUL”TLD with a high abuse rate “quest”
punycode name “小小宇 scripts=CJK”TLD with a high abuse rate “icu”
punycode name “크로진스 scripts=HANGUL”TLD with a high abuse rate “quest”
punycode name “銀河貴賓會 scripts=CJK”TLD with a high abuse rate “top”
punycode name “萬興科技 scripts=CJK”TLD with a high abuse rate “top”
punycode name “雀众淘 scripts=CJK”TLD with a high abuse rate “xyz”
punycode name “朧 scripts=CJK”TLD with a high abuse rate “top”
punycode name “箫 scripts=CJK”TLD with a high abuse rate “top”
punycode name “詞了么 scripts=CJK”TLD with a high abuse rate “top”
punycode name “词了么 scripts=CJK”TLD with a high abuse rate “top”
punycode name “银河贵宾会 scripts=CJK”TLD with a high abuse rate “top”
punycode name “银河贵宾会 scripts=CJK”TLD with a high abuse rate “xyz”
punycode name “比特币 scripts=CJK”TLD with a high abuse rate “top”
punycode name “舜 scripts=CJK”TLD with a high abuse rate “top”
punycode name “永劫無間 scripts=CJK”TLD with a high abuse rate “top”
punycode name “云奴 scripts=CJK”TLD with a high abuse rate “xyz”
punycode name “迅云 scripts=CJK”TLD with a high abuse rate “top”
punycode name “江許 scripts=CJK”TLD with a high abuse rate “top”
punycode name “江许 scripts=CJK”TLD with a high abuse rate “top”
punycode name “咕 scripts=CJK”TLD with a high abuse rate “xyz”
punycode name “訊 scripts=CJK”TLD with a high abuse rate “top”
punycode name “ai量子芯片 scripts=CJK/LATIN”TLD with a high abuse rate “top”
punycode name “讯 scripts=CJK”TLD with a high abuse rate “top”
punycode name “bitpie錢包 scripts=CJK/LATIN”TLD with a high abuse rate “top”
punycode name “茵 scripts=CJK”TLD with a high abuse rate “top”
punycode name “任小聊 scripts=CJK”TLD with a high abuse rate “top”
punycode name “箍 scripts=CJK”TLD with a high abuse rate “top”
punycode name “万兴科技 scripts=CJK”TLD with a high abuse rate “hair”
punycode name “万兴科技 scripts=CJK”TLD with a high abuse rate “quest”
punycode name “万兴科技 scripts=CJK”TLD with a high abuse rate “skin”
punycode name “万兴科技 scripts=CJK”TLD with a high abuse rate “top”
punycode name “万兴科技 scripts=CJK”TLD with a high abuse rate “work”
Same data as JSON: /api/zone/risk?day=2026-10-30&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.