Flagged newborn domains, Sunday, November 1, 2026
7,024 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
lure words (login, verify, secure…) “portal,reward,rewards”
lure words (login, verify, secure…) “prize,reward,rewards”
form on a brand-styled page “has_form”
lure words (login, verify, secure…) “billing,service,services”
many hyphens “4”very long name “28”TLD with a high abuse rate “sbs”
lure words (login, verify, secure…) “service,services,support”
lure words (login, verify, secure…) “secure”very long name “30”TLD with a high abuse rate “cfd”
lure words (login, verify, secure…) “secure”very long name “30”TLD with a high abuse rate “cfd”
lure words (login, verify, secure…) “gov,service”form submits over plain HTTP “http://service-gov.online/”
lure words (login, verify, secure…) “gov,service”form submits over plain HTTP “http://service-gov.org/”
lure words (login, verify, secure…) “account,accounts”form submits over plain HTTP “http://shekels-accounts.online/”
lure words (login, verify, secure…) “account,accounts”form submits over plain HTTP “http://shekelsaccounts.online/”
lure words (login, verify, secure…) “customer,customers,support”
many hyphens “4”very long name “32”TLD with a high abuse rate “top”
brand in the name “etsy”very long name “30”
form on a brand-styled page “has_form”
many hyphens “4”very long name “28”TLD with a high abuse rate “homes”
many hyphens “4”very long name “34”TLD with a high abuse rate “top”
punycode name “крымская-ипотека scripts=CYRILLIC”
punycode name “мой-подход scripts=CYRILLIC”
punycode name “ꜱᴀᴛᴛᴀ-ᴋɪɴɢ scripts=LATIN”
punycode name “천안아산역-그랑시티필하우스 scripts=HANGUL”
punycode name “تاكسي-جابرالاحمد scripts=ARABIC”
punycode name “تاكسي-العارضيه scripts=ARABIC”
punycode name “صيانة-مطابخ scripts=ARABIC”
punycode name “تاكسي-الفردوس scripts=ARABIC”
punycode name “શુન્યાવકાશ scripts=GUJARATI”
punycode name “胜境电玩 scripts=CJK”
punycode name “顾和淘 scripts=CJK”
punycode name “1бз scripts=CYRILLIC”
punycode name “เย็ดสบัด1 scripts=THAI”
punycode name “แอบเย็ด1 scripts=THAI”
punycode name “เว็บเป็นหนึ่ง100 scripts=THAI”
punycode name “ग्राहकसेवा scripts=DEVANAGARI”
punycode name “แพรกษาดีเซล scripts=THAI”
punycode name “贯秦淘 scripts=CJK”
punycode name “嘎子 scripts=CJK”
punycode name “รวย1577 scripts=THAI”
punycode name “酒水大全 scripts=CJK”
punycode name “酒水大全 scripts=CJK”
punycode name “เฮงฮิต168 scripts=THAI”
punycode name “อาเฮีย168 scripts=THAI”
punycode name “หนัง18ไทย scripts=THAI”
punycode name “1ใน8พันล้าน scripts=THAI”
punycode name “คลิปเสียว18 scripts=THAI”
punycode name “คลิปมันส์18 scripts=THAI”
punycode name “ดูคลิป18 scripts=THAI”
punycode name “상담예약1800-2770 scripts=HANGUL”
punycode name “民富 scripts=CJK”
punycode name “晓杨 scripts=CJK”
Same data as JSON: /api/zone/risk?day=2026-11-01&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.