Flagged newborn domains, Monday, November 2, 2026

590 names at tier high or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalrobloxaccountvalue.comscore 100echoes roblox· active website
brand in the name “roblox”lure words (login, verify, secure…) “account”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”+2 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalph4nt0mxwire.lolscore 95echoes phantom· active website
brand spelled with digits “ph4nt0mxwire→phantom”brand plus digits “ph4nt0mxwire”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalcoinbaseaccountsupport.comscore 92echoes coinbase· active website
brand in the name “coinbase”lure words (login, verify, secure…) “account,accounts,support”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Coinbase), confidence 72%. An opinion, not a finding.

Criticalesellerstoreebay.shopscore 83echoes ebay· active website
brand in the name “ebay”brand name behind Cloudflare “cloudflare.com”page pushes urgent payment “Limited time offer”brand name and brand-styled page “ebay”+1 more

Model opinion: looks like phishing (target: eBay), confidence 88%. An opinion, not a finding.

Criticalbinancejinku.funscore 78echoes binance· active website
brand in the name “binance”TLD with a high abuse rate “fun”page impersonates a brand “Binance”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Binance), confidence 85%. An opinion, not a finding.

Criticalte1egram.lolscore 77echoes telegram· active website
brand spelled with digits “te1egram→telegram”brand plus digits “te1egram”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like phishing (target: Telegram), confidence 93%. An opinion, not a finding.

Criticalbinancesituation.livescore 73echoes binance· active website
brand in the name “binance”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Binance”brand name and brand-styled page “binance”

Model opinion: looks like a scam (target: Binance), confidence 86%. An opinion, not a finding.

Criticalhub24hr.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 75%. An opinion, not a finding.

Criticalmar-ket-plate.orgscore 68· active website
page asks for credentials “Sign in to your account”brand in page title, not in the name “lazada”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Lazada), confidence 90%. An opinion, not a finding.

Criticalopenaidrop.comscore 67echoes openai· active website
brand in the name “openai”page impersonates a brand “MetaMask”brand name and brand-styled page “openai”

Model opinion: looks like phishing (target: OpenAI), confidence 95%. An opinion, not a finding.

Criticalmuzelle.orgscore 62echoes zelle· active website
brand in the name “zelle”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalspetsy-new.lolscore 62echoes etsy· active website
brand in the name “etsy”TLD with a high abuse rate “lol”page impersonates a brand “NETFLIX”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalbhtai.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalbnai.tradescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Binance), confidence 80%. An opinion, not a finding.

Criticalchannelofhope.onlinescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticaldectom.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticaldigitalyol.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Criticaldunamsgroup.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalelevatewealthcollective.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalelitehsp.techscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalessegitv.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “starlink”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalhdmovie2a.bestscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 93%. An opinion, not a finding.

Criticalkdps.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalmattdds.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalottsfrictionsupply.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticaloutphone.appscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalpersec.appscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “authenticator”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalpochtamiami.comscore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalpowerforge.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalpricehike.appscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalpurifydata.techscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalredaest.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalredneckpower.sitescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalrendivo.appscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalstraubhome.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticaltycooncity.livescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalwa-cloud.topscore 60echoes icloud· active website
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalzavify.orgscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Higharenaplaystation.comscore 59echoes playstation· active website
brand in the name “playstation”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand name and brand-styled page “playstation”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Highxboxnexus.onlinescore 59echoes xbox· active website
brand in the name “xbox”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”brand name and brand-styled page “xbox”

Model opinion: looks like abuse (target: Xbox (Microsoft)), confidence 62%. An opinion, not a finding.

Highahahahashdsahdashasdhahahahahahahaha.lolscore 58· active website
very long name “36”TLD with a high abuse rate “lol”free DNS provider “dnsowl.com”brand in page title, not in the name “telegram”+1 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highanthropicrobin.lolscore 58echoes anthropic· active website
brand in the name “anthropic”TLD with a high abuse rate “lol”brand in page title, not in the name “robinhood”

Model opinion: looks like a scam (target: Anthropic), confidence 88%. An opinion, not a finding.

Highwechat-ue.cfdscore 58echoes wechat· active website
brand in the name “wechat”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: looks like phishing (target: WeChat), confidence 85%. An opinion, not a finding.

Highbinanceverify.livescore 56echoes binance· active website
brand in the name “binance”lure words (login, verify, secure…) “verify”

Model opinion: looks like abuse (target: Binance), confidence 85%. An opinion, not a finding.

High789betmobile.infoscore 55echoes tmobile· no DNS
brand in the name “tmobile”brand plus digits “789betmobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: looks like abuse, confidence 55%. An opinion, not a finding.

Highabiz-galaxy-mobile.sitescore 55echoes tmobile· redirects elsewhere
one-letter brand typo “mobile≈tmobile”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “google”form on a brand-styled page “has_form”+1 more

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highaccounts-shopity.comscore 55echoes shopify
one-letter brand typo “shopity≈shopify”lure words (login, verify, secure…) “account,accounts”

Model opinion: suspicious (target: shopify), confidence 63%. An opinion, not a finding.

Highadobeupdate.websitescore 55echoes adobe· no DNS
brand in the name “adobe”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”

Model opinion: suspicious (target: adobe), confidence 56%. An opinion, not a finding.

Highamazonsecuredocument-submissionportal.netscore 55echoes amazon· empty page
brand in the name “amazon”lure words (login, verify, secure…) “portal,secure”very long name “37”brand name at a retail registrar “Wix.com Ltd.”

Model opinion: looks like abuse (target: Amazon), confidence 82%. An opinion, not a finding.

Highapple-service.comscore 55echoes apple
brand in the name “apple”lure words (login, verify, secure…) “service”

Same data as JSON: /api/zone/risk?day=2026-11-02&tier=high. Screenshots and the model's reasoning are on each domain's evidence page.