Flagged newborn domains, Tuesday, November 3, 2026

9,531 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Lowph1login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph222login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph222login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph22login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph22login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph33login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph33login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph35login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph35login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph365login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph365login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph444login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph444login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph44login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph44login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph62login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph62login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph777login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph777login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph78login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph78login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph8login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph8login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph90login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph90login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowph96login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowph96login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowphantom-d.comscore 14echoes phantom· boilerplate page
ambiguous brand word “phantom”identical page on many newborns “664 identical pages”
Lowpharmaconnect.shopscore 14· active website
login form “has_form+login words”
Lowphcashlogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphdreamlogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphdreamlogin.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowphjllogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphjllogin.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowphjoinlogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphjoinlogin.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowphjoylogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphlovelogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphmacaologin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphmobalogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphpopularlogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphpviplogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphskylogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphspinlogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphtayalogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphwinlogin.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowphwinlogin.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”
Lowpin-up-casino-sgj4.cfdscore 14· no DNS
many hyphens “3”TLD with a high abuse rate “cfd”
Lowpinas77login.cyouscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “cyou”
Lowpinas77login.icuscore 14· no DNS
lure words (login, verify, secure…) “login”TLD with a high abuse rate “icu”

Same data as JSON: /api/zone/risk?day=2026-11-03&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.