Flagged newborn domains, Thursday, November 5, 2026
10,864 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “Paypal”
page impersonates a brand “PayPal”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “Binance”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
page impersonates a brand “IRS”
page impersonates a brand “PayPal”
TLD with a high abuse rate “top”login form “has_form+login words”
lure words (login, verify, secure…) “auth,login”many hyphens “6”very long name “42”
lure words (login, verify, secure…) “service,services”many hyphens “8”very long name “55”
page impersonates a brand “PayPal”
page impersonates a brand “Office 365”
page impersonates a brand “Binance”
TLD with a high abuse rate “beauty”login form “has_form+login words”
TLD with a high abuse rate “cfd”login form “has_form+login words”
TLD with a high abuse rate “click”login form “has_form+login words”
TLD with a high abuse rate “homes”login form “has_form+login words”
TLD with a high abuse rate “monster”login form “has_form+login words”
TLD with a high abuse rate “sbs”login form “has_form+login words”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “PayPal”
punycode name “경산상방공원호반써밋 scripts=HANGUL”very long name “34”
punycode name “이삭안경창원상남점 scripts=HANGUL”very long name “32”
punycode name “교통사고전문변호사 scripts=HANGUL”very long name “32”
punycode name “한국불법사채구제센터 scripts=HANGUL”very long name “35”
punycode name “산곡자이힐스테이트하늘채 scripts=HANGUL”very long name “40”
punycode name “산곡역자이힐스테이트앤하늘채 scripts=HANGUL”very long name “46”
punycode name “한국스포츠심포니재단 scripts=HANGUL”very long name “35”
punycode name “태화강전국걷기대회 scripts=HANGUL”very long name “31”
punycode name “엘지한강자이아파트 scripts=HANGUL”very long name “32”
punycode name “cabañasensantarosadecalamuchita scripts=”very long name “31”
punycode name “cerenesenakdağmadenibayantaksi scripts=L”very long name “30”
punycode name “führerschein-laienausbildung scripts=LAT”very long name “28”
punycode name “雅絜車體美容中心 scripts=CJK”very long name “31”
punycode name “奶龙中医药科学院 scripts=CJK”very long name “30”
punycode name “中国优质食用油供应商 scripts=CJK”very long name “34”
punycode name “gerconsultoriadiseñoyconstruccionessas s”very long name “38”
punycode name “모두를위한지속성장 scripts=HANGUL”very long name “33”
punycode name “أفضلالكازينوهاتعلىالإنترنت scripts=ARABI”very long name “39”
punycode name “雪雪不是白毛小萝莉 scripts=CJK”very long name “31”
punycode name “taraftarium24tarafkolikgiriş scripts=LAT”very long name “28”
punycode name “taraftarium24tarafkolikgirişler scripts=”very long name “31”
punycode name “두근두근숯불갈비 scripts=HANGUL”very long name “28”
punycode name “건우시스템에어컨 scripts=HANGUL”very long name “29”
TLD with a high abuse rate “fun”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “Binance”
TLD with a high abuse rate “xyz”login form “has_form+login words”
Same data as JSON: /api/zone/risk?day=2026-11-05&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.