Flagged newborn domains, Thursday, November 5, 2026

2,684 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highmyamazonguysupport.infoscore 54echoes amazon· not probed yet
brand in the name “amazon”lure words (login, verify, secure…) “support”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
Highmytmobilelogin.orgscore 54echoes tmobile· not probed yet
brand in the name “tmobile”lure words (login, verify, secure…) “login”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
Highnvidiainu.funscore 54echoes nvidia· redirects elsewhere
brand in the name “nvidia”TLD with a high abuse rate “fun”brand name at a retail registrar “Tucows Domains Inc.”brand name redirects elsewhere “expiredwixdomain.com”

Model opinion: looks like abuse (target: NVIDIA), confidence 62%. An opinion, not a finding.

Highpaypalpay.cashscore 54echoes paypal· parked, for sale
brand in the name “paypal”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “238 identical pages”brand name redirects elsewhere “urldance.com”
Highpaypul.clickscore 54echoes paypal· boilerplate page
one-letter brand typo “paypul≈paypal”TLD with a high abuse rate “click”brand name at a retail registrar “Tucows Domains Inc.”identical page on many newborns “2570 identical pages”

Model opinion: looks like abuse (target: PayPal), confidence 70%. An opinion, not a finding.

Highpechat-varhu-tekstil.comscore 54echoes wechat· active website
one-letter brand typo “pechat≈wechat”brand name at a retail registrar “Register SPA”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Highpeptiktok.comscore 54echoes tiktok· registrar placeholder
brand in the name “tiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “602 identical pages”
Highsupportcoinbasespain.comscore 54echoes coinbase· no DNS
brand in the name “coinbase”lure words (login, verify, secure…) “support”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
Highvanguardiaplus.digitalscore 54echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Highvanguardtruckoutfitters.comscore 54echoes vanguard· registrar placeholder
brand in the name “vanguard”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “602 identical pages”
Highamazonfba.storescore 53echoes amazon· active website
brand in the name “amazon”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “amazon”
Highcapita1one.onlinescore 53echoes capitalone· parked with ads
brand spelled with digits “capita1one→capitalone”brand plus digits “capita1one”identical page on many newborns “91 identical pages”

Model opinion: looks like abuse (target: Capital One), confidence 85%. An opinion, not a finding.

Highcapita1one.storescore 53echoes capitalone· parked with ads
brand spelled with digits “capita1one→capitalone”brand plus digits “capita1one”identical page on many newborns “91 identical pages”

Model opinion: looks like abuse (target: Capital One), confidence 85%. An opinion, not a finding.

Highebaydeletionhandler.orgscore 53echoes ebay· active website
brand in the name “ebay”brand name at a retail registrar “Tucows Domains Inc.”brand name and brand-styled page “ebay”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highsemper-fidelity.infoscore 53echoes fidelity· active website
brand in the name “fidelity”brand name at a retail registrar “IONOS SE”brand name and brand-styled page “fidelity”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Hightheorio373-gmail-com.storescore 53echoes gmail· other
brand in the name “gmail”brand plus digits “theorio373-gmail-com”brand name and brand-styled page “gmail”

Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.

Hightiktokviet.appscore 53echoes tiktok· empty page
brand in the name “tiktok”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “tiktok”

Model opinion: looks like abuse (target: TikTok), confidence 55%. An opinion, not a finding.

Highworkdaypro.appscore 53echoes workday· active website
brand in the name “workday”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “workday”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

High1023gmail.comscore 52echoes gmail
brand in the name “gmail”brand plus digits “1023gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
High132832coinbase.comscore 52echoes coinbase
brand in the name “coinbase”brand plus digits “132832coinbase”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
High394834binance.comscore 52echoes binance
brand in the name “binance”brand plus digits “394834binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
High7783eadobe.comscore 52echoes adobe
brand in the name “adobe”brand plus digits “7783eadobe”brand name on a rarely-seen nameserver “register.ca”brand name at a retail registrar “Register.ca Inc.”
High798437-google.comscore 52echoes google
brand in the name “google”brand plus digits “798437-google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CNOBIN INFORMATION TECHNOLOGY LIMITED”
Highadobedrywalls.comscore 52echoes adobe
brand in the name “adobe”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Highadobeinstalledown.icuscore 52echoes adobe· not probed yet
brand in the name “adobe”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”
Highalipay88.comscore 52echoes alipay
brand in the name “alipay”brand plus digits “alipay88”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Amazon Registrar, Inc.”
Highamazon789.blogscore 52echoes amazon· active website
brand in the name “amazon”brand plus digits “amazon789”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”

Model opinion: looks like abuse (target: Amazon), confidence 68%. An opinion, not a finding.

Highaml2-binance.comscore 52echoes binance
brand in the name “binance”brand plus digits “aml2-binance”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Register SPA”
Highangelic-209853-myshopify-com.storescore 52echoes shopify· other
brand in the name “shopify”many hyphens “3”very long name “28”brand plus digits “angelic-209853-myshopify-com”+1 more

Model opinion: looks like abuse (target: Shopify), confidence 60%. An opinion, not a finding.

Highbinanceuni.lolscore 52echoes binance· not probed yet
brand in the name “binance”TLD with a high abuse rate “lol”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
Highcasinopaypal.sbsscore 52echoes paypal· not probed yet
brand in the name “paypal”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “URL Solutions, Inc.”
Highcrypto-schwab.comscore 52echoes schwab· robots.txt denied
brand in the name “schwab”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
Highfinance-proposal.clickscore 52echoes binance· boilerplate page
one-letter brand typo “finance≈binance”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “52 identical pages”

Model opinion: unreachable when judged, confidence 60%. An opinion, not a finding.

Highgmail4x.sitescore 52echoes gmail· no DNS
brand in the name “gmail”brand plus digits “gmail4x”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “CSL Computer Service Langenbach GmbH d/b”
Highgoogleteam.lolscore 52echoes google· not probed yet
brand in the name “google”TLD with a high abuse rate “lol”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
Highhi-go-cloud.comscore 52echoes icloud· registrar placeholder
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “602 identical pages”

Model opinion: looks benign, confidence 80%. An opinion, not a finding.

Highicloud-in.xyzscore 52echoes icloud· not probed yet
brand in the name “icloud”TLD with a high abuse rate “xyz”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Highj9facebook.comscore 52echoes facebook
brand in the name “facebook”brand plus digits “j9facebook”brand name on a rarely-seen nameserver “xdnspro.com”brand name at a retail registrar “Name.com, Inc.”
Highjenniferbaumgarner34gmail.comscore 52echoes gmail
brand in the name “gmail”brand plus digits “jenniferbaumgarner34gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Highmicrosoftontine.comscore 52echoes microsoft· redirects elsewhere
brand in the name “microsoft”brand name on a rarely-seen nameserver “domeny.tv”brand name at a retail registrar “eNom, LLC”brand name redirects elsewhere “domeny.tv”

Model opinion: looks like abuse (target: Microsoft), confidence 85%. An opinion, not a finding.

Highmineme.xyzscore 52echoes lineme· parked, for sale
one-letter brand typo “mineme≈lineme”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”brand name redirects elsewhere “atom.com”

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Highscotiabank-mobile2fa.comscore 52echoes scotiabank
brand in the name “scotiabank”brand plus digits “scotiabank-mobile2fa”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
Hightelegrambots.xyzscore 52echoes telegram· not probed yet
brand in the name “telegram”TLD with a high abuse rate “xyz”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
Hightelegramkelong.topscore 52echoes telegram· no DNS
brand in the name “telegram”TLD with a high abuse rate “top”brand name at a retail registrar “Gname.com Pte. Ltd.”brand name at a watch-list registrar “Gname.com Pte. Ltd.”
Hightiktok-link.xyzscore 52echoes tiktok· empty page
brand in the name “tiktok”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”

Model opinion: looks like abuse (target: TikTok), confidence 70%. An opinion, not a finding.

Hightiktok29.comscore 52echoes tiktok
brand in the name “tiktok”brand plus digits “tiktok29”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Highvanguardexpert28.comscore 52echoes vanguard
brand in the name “vanguard”brand plus digits “vanguardexpert28”brand name on a rarely-seen nameserver “orangehost.com”brand name at a retail registrar “OrangeHost LLC”
Highwechatdownload.xyzscore 52echoes wechat· no DNS
brand in the name “wechat”TLD with a high abuse rate “xyz”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
Highwhatsapplmao.cfdscore 52echoes whatsapp· not probed yet
brand in the name “whatsapp”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameMart Pte. Ltd.”
Highwordpress2shell.comscore 52echoes wordpress
brand in the name “wordpress”brand plus digits “wordpress2shell”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”

Same data as JSON: /api/zone/risk?day=2026-11-05&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.