Flagged newborn domains, Monday, November 2, 2026

38 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalrobloxaccountvalue.comscore 100echoes roblox· active website
brand in the name “roblox”lure words (login, verify, secure…) “account”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”+2 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalph4nt0mxwire.lolscore 95echoes phantom· active website
brand spelled with digits “ph4nt0mxwire→phantom”brand plus digits “ph4nt0mxwire”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”+2 more

Model opinion: suspicious, confidence 60%. An opinion, not a finding.

Criticalcoinbaseaccountsupport.comscore 92echoes coinbase· active website
brand in the name “coinbase”lure words (login, verify, secure…) “account,accounts,support”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Coinbase), confidence 72%. An opinion, not a finding.

Criticalesellerstoreebay.shopscore 83echoes ebay· active website
brand in the name “ebay”brand name behind Cloudflare “cloudflare.com”page pushes urgent payment “Limited time offer”brand name and brand-styled page “ebay”+1 more

Model opinion: looks like phishing (target: eBay), confidence 88%. An opinion, not a finding.

Criticalbinancejinku.funscore 78echoes binance· active website
brand in the name “binance”TLD with a high abuse rate “fun”page impersonates a brand “Binance”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Binance), confidence 85%. An opinion, not a finding.

Criticalte1egram.lolscore 77echoes telegram· active website
brand spelled with digits “te1egram→telegram”brand plus digits “te1egram”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: looks like phishing (target: Telegram), confidence 93%. An opinion, not a finding.

Criticalbinancesituation.livescore 73echoes binance· active website
brand in the name “binance”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Binance”brand name and brand-styled page “binance”

Model opinion: looks like a scam (target: Binance), confidence 86%. An opinion, not a finding.

Criticalhub24hr.xyzscore 68· active website
TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 75%. An opinion, not a finding.

Criticalmar-ket-plate.orgscore 68· active website
page asks for credentials “Sign in to your account”brand in page title, not in the name “lazada”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Lazada), confidence 90%. An opinion, not a finding.

Criticalopenaidrop.comscore 67echoes openai· active website
brand in the name “openai”page impersonates a brand “MetaMask”brand name and brand-styled page “openai”

Model opinion: looks like phishing (target: OpenAI), confidence 95%. An opinion, not a finding.

Criticalmuzelle.orgscore 62echoes zelle· active website
brand in the name “zelle”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalspetsy-new.lolscore 62echoes etsy· active website
brand in the name “etsy”TLD with a high abuse rate “lol”page impersonates a brand “NETFLIX”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalbhtai.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalbnai.tradescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Binance), confidence 80%. An opinion, not a finding.

Criticalchannelofhope.onlinescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticaldectom.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticaldigitalyol.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Criticaldunamsgroup.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalelevatewealthcollective.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalelitehsp.techscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalessegitv.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “starlink”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalhdmovie2a.bestscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 93%. An opinion, not a finding.

Criticalkdps.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “chatgpt”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalmattdds.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalottsfrictionsupply.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticaloutphone.appscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “whatsapp”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalpersec.appscore 60· active website
page impersonates a brand “Microsoft 365”brand in page title, not in the name “authenticator”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Criticalpochtamiami.comscore 60· active website
page impersonates a brand “FedEx”brand in page title, not in the name “fedex”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalpowerforge.shopscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalpricehike.appscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalpurifydata.techscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalredaest.comscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalredneckpower.sitescore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalrendivo.appscore 60· active website
page impersonates a brand “PayPal”brand in page title, not in the name “paypal”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Criticalstraubhome.comscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 95%. An opinion, not a finding.

Criticaltycooncity.livescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “binance”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalwa-cloud.topscore 60echoes icloud· active website
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Criticalzavify.orgscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-11-02&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.