Flagged newborn domains, Sunday, November 1, 2026

580 names at tier high or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highgoogle-verify-portal.comscore 55echoes google
brand in the name “google”lure words (login, verify, secure…) “portal,verify”lure suffix “google-verify-portal”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: google), confidence 74%. An opinion, not a finding.

Highhklogin-whatsapp.xyzscore 55echoes whatsapp· no DNS
brand in the name “whatsapp”lure words (login, verify, secure…) “login”TLD with a high abuse rate “xyz”

Model opinion: suspicious (target: whatsapp), confidence 62%. An opinion, not a finding.

Highhus4a.sitescore 55echoes usaa· empty page
brand spelled with digits “hus4a→usaa”brand plus digits “hus4a”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.

Highid-icloud.clickscore 55echoes icloud· no DNS
brand in the name “icloud”lure words (login, verify, secure…) “id”TLD with a high abuse rate “click”free DNS provider “dnsowl.com”

Model opinion: looks like abuse (target: Apple), confidence 78%. An opinion, not a finding.

Highintuitewebas.sbsscore 55echoes intuit· not probed yet
brand in the name “intuit”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: suspicious (target: intuit), confidence 63%. An opinion, not a finding.

Highintuiteydsxs.sbsscore 55echoes intuit· not probed yet
brand in the name “intuit”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: suspicious (target: intuit), confidence 53%. An opinion, not a finding.

Highinvoicemembers-linkedin.comscore 55echoes linkedin
brand in the name “linkedin”lure words (login, verify, secure…) “invoice,member,members”
Highis0-apple.topscore 55echoes apple· no web server
brand in the name “apple”brand plus digits “is0-apple”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”+2 more
Highlcloud-com-security-blog.helpscore 55echoes icloud· no DNS
one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “security”many hyphens “3”brand name on a rarely-seen nameserver “dsloginpanel.pro”
Highlcloud-wb.clickscore 55echoes icloud· robots.txt denied
one-letter brand typo “lcloud≈icloud”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Highledger-live-recovery.comscore 55echoes ledger
brand in the name “ledger”lure words (login, verify, secure…) “recover,recovery”
Highlnstagram-services.comscore 55echoes instagram
one-letter brand typo “lnstagram≈instagram”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Squarespace Domains II LLC”
Highmobile.housescore 55echoes tmobile· redirects elsewhere
one-letter brand typo “mobile≈tmobile”brand name on a rarely-seen nameserver “dccdns.com”form on a brand-styled page “has_form”brand name redirects elsewhere “domaincostclub.com”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highmundonintendo.storescore 55echoes nintendo· redirects elsewhere
brand in the name “nintendo”brand name on a rarely-seen nameserver “halejop.com”brand in page title, not in the name “whatsapp”

Model opinion: looks like abuse (target: Nintendo), confidence 70%. An opinion, not a finding.

Highmynotes-cloud.xyzscore 55echoes icloud· no DNS
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Porkbun LLC”+1 more
Highpayinvoice-linkedin.comscore 55echoes linkedin
brand in the name “linkedin”lure words (login, verify, secure…) “invoice”
Highpaypalsecurelogin.comscore 55echoes paypal
brand in the name “paypal”lure words (login, verify, secure…) “login,secure”
Highsaobao.lolscore 55echoes taobao· not probed yet
one-letter brand typo “saobao≈taobao”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highschwab-file-for-tax.comscore 55echoes schwab
brand in the name “schwab”lure words (login, verify, secure…) “tax”many hyphens “3”
Highshopeexyz.xyzscore 55echoes shopee· no DNS
brand in the name “shopee”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Highshopify-checkout.clickscore 55echoes shopify· robots.txt denied
brand in the name “shopify”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
Highshopify-compliance-security.clickscore 55echoes shopify· no DNS
brand in the name “shopify”lure words (login, verify, secure…) “security”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
Highshopify-pay.newsscore 55echoes shopify· boilerplate page
brand in the name “shopify”lure words (login, verify, secure…) “pay”identical page on many newborns “1844 identical pages”

Model opinion: looks like abuse (target: Shopify), confidence 62%. An opinion, not a finding.

Highsignin-ledger.comscore 55echoes ledger· no DNS
brand in the name “ledger”lure words (login, verify, secure…) “signin”
Highslacker51.topscore 55echoes slack· no DNS
brand in the name “slack”brand plus digits “slacker51”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”+1 more
Highsonaroebay.infoscore 55echoes ebay· registrar placeholder
brand in the name “ebay”form on a brand-styled page “has_form”identical page on many newborns “1562 identical pages”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Highsonaroebay.storescore 55echoes ebay· registrar placeholder
brand in the name “ebay”form on a brand-styled page “has_form”identical page on many newborns “1562 identical pages”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highstarlinksecure.netscore 55echoes starlink
brand in the name “starlink”lure words (login, verify, secure…) “secure”
Highstonk-rewards.topscore 55· blocked the probe
lure words (login, verify, secure…) “reward,rewards”TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
Highstripeinvoice.onlinescore 55echoes stripe· redirects elsewhere
brand in the name “stripe”lure words (login, verify, secure…) “invoice”brand name at a retail registrar “IONOS SE”form on a brand-styled page “has_form”+1 more

Model opinion: looks like abuse (target: Stripe), confidence 70%. An opinion, not a finding.

Highsupport-apple-id.shopscore 55echoes apple· robots.txt denied
brand in the name “apple”lure words (login, verify, secure…) “id,support”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”+1 more
Hightiktok-game.clickscore 55echoes tiktok· robots.txt denied
brand in the name “tiktok”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot, LLC”+1 more
Hightiktook.onlinescore 55echoes tiktok· registrar placeholder
one-letter brand typo “tiktook≈tiktok”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: looks like abuse (target: TikTok), confidence 74%. An opinion, not a finding.

Hightrackit4u.comscore 55echoes itau
brand spelled with digits “trackit4u→itau”lure words (login, verify, secure…) “track”brand plus digits “trackit4u”brand name behind Cloudflare “cloudflare.com”
Hightrezor-alerts.icuscore 55echoes trezor· no DNS
brand in the name “trezor”lure words (login, verify, secure…) “alert,alerts”TLD with a high abuse rate “icu”
Hightrustwallet-wb3.comscore 55echoes trustwallet
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand plus digits “trustwallet-wb3”
Hightrustwalletgas.sitescore 55echoes trustwallet· no DNS
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”
brand in the name “uber”lure words (login, verify, secure…) “verification”many hyphens “6”very long name “60”+1 more
Highusaaccessonline.comscore 55echoes usaa
brand in the name “usaa”lure words (login, verify, secure…) “access”brand name behind Cloudflare “cloudflare.com”
Highuser49-stripe.comscore 55echoes stripe
brand in the name “stripe”brand plus digits “user49-stripe”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Highvangurd.clickscore 55echoes vanguard· registrar placeholder
one-letter brand typo “vangurd≈vanguard”TLD with a high abuse rate “click”brand name at a retail registrar “NAMECHEAP”brand name at a watch-list registrar “NAMECHEAP”+1 more
Highvangurd.lolscore 55echoes vanguard· no DNS
one-letter brand typo “vangurd≈vanguard”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Highwa-whatsapp.xyzscore 55echoes whatsapp· boilerplate page
brand in the name “whatsapp”TLD with a high abuse rate “xyz”brand name at a retail registrar “Vantage of Convergence (Chengdu) Technol”identical page on many newborns “129 identical pages”
Highwa01-whatsapp.xyzscore 55echoes whatsapp· boilerplate page
brand in the name “whatsapp”brand plus digits “wa01-whatsapp”TLD with a high abuse rate “xyz”identical page on many newborns “129 identical pages”
Highwab-whatsapp.xyzscore 55echoes whatsapp· boilerplate page
brand in the name “whatsapp”TLD with a high abuse rate “xyz”brand name at a retail registrar “Vantage of Convergence (Chengdu) Technol”identical page on many newborns “129 identical pages”
Highwb3-trustwallet.comscore 55echoes trustwallet
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand plus digits “wb3-trustwallet”
Highwellsfargoalerts.netscore 55echoes wellsfargo
brand in the name “wellsfargo”lure words (login, verify, secure…) “alert,alerts”
Highxn--revolu-nlb.comscore 55echoes revolut
punycode name “revoluŧ scripts=LATIN”one-letter brand typo “revolu≈revolut”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
Highbestbuygrn.onlinescore 54echoes bestbuy· registrar placeholder
brand in the name “bestbuy”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “2848 identical pages”
Highchatgptads.expertscore 54echoes chatgpt· registrar placeholder
brand in the name “chatgpt”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “2848 identical pages”

Model opinion: looks like abuse (target: OpenAI (ChatGPT)), confidence 60%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-11-01&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.