Flagged newborn domains, Friday, November 6, 2026

12,218 names at tier low or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalvoipandcrm.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalyourvirtualteam.onlinescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticalzivoll.storescore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Highfxoutlook.newsscore 59echoes outlook· active website
brand in the name “outlook”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “outlook”

Model opinion: looks benign, confidence 86%. An opinion, not a finding.

Highvyroblox.sitescore 59echoes roblox· active website
brand in the name “roblox”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “roblox”

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Highvanguardai.clickscore 58echoes vanguard· active website
brand in the name “vanguard”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highbedreaders-docusignatures.xyzscore 57echoes docusign· active website
brand in the name “docusign”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+2 more

Model opinion: looks like abuse (target: Docusign), confidence 90%. An opinion, not a finding.

Highinstagramvideodownloaderapp.onlinescore 56echoes instagram· active website
brand in the name “instagram”brand name at a retail registrar “GoDaddy.com, LLC”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Instagram), confidence 60%. An opinion, not a finding.

Highlaada.hairscore 56echoes lazada· active website
one-letter brand typo “laada≈lazada”TLD with a high abuse rate “hair”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

High039274coinbase.comscore 55echoes coinbase
brand in the name “coinbase”brand plus digits “039274coinbase”random-looking name “H=3.81”brand name at a retail registrar “Dynadot Inc”+1 more

Model opinion: suspicious (target: coinbase), confidence 71%. An opinion, not a finding.

High283345coinbase.comscore 55echoes coinbase
brand in the name “coinbase”brand plus digits “283345coinbase”random-looking name “H=3.66”brand name behind Cloudflare “cloudflare.com”+1 more

Model opinion: suspicious (target: coinbase), confidence 69%. An opinion, not a finding.

High354634coinbase.comscore 55echoes coinbase
brand in the name “coinbase”brand plus digits “354634coinbase”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: suspicious (target: coinbase), confidence 72%. An opinion, not a finding.

High384238-apple.comscore 55echoes apple
brand in the name “apple”brand plus digits “384238-apple”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: suspicious (target: apple), confidence 77%. An opinion, not a finding.

High394394-apple.comscore 55echoes apple
brand in the name “apple”brand plus digits “394394-apple”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: suspicious (target: apple), confidence 76%. An opinion, not a finding.

High592307-trezor.comscore 55echoes trezor
brand in the name “trezor”brand plus digits “592307-trezor”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more

Model opinion: suspicious (target: trezor), confidence 77%. An opinion, not a finding.

High713942google.comscore 55echoes google
brand in the name “google”brand plus digits “713942google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
High88vay.appscore 55echoes bbva· not probed yet
brand spelled with digits “88vay→bbva”brand plus digits “88vay”brand name at a retail registrar “Dynadot LLC.”brand name at a watch-list registrar “Dynadot LLC.”
High983270coinbase.comscore 55echoes coinbase
brand in the name “coinbase”brand plus digits “983270coinbase”random-looking name “H=3.81”brand name behind Cloudflare “cloudflare.com”+2 more
Highaccount-shopifiy.comscore 55echoes shopify
one-letter brand typo “shopifiy≈shopify”lure words (login, verify, secure…) “account,accounts”brand name behind Cloudflare “cloudflare.com”
Highad0besecureremote.topscore 55echoes adobe· no web server
brand spelled with digits “ad0besecureremote→adobe”lure words (login, verify, secure…) “secure”brand plus digits “ad0besecureremote”TLD with a high abuse rate “top”+1 more
Highadobe-billing.comscore 55echoes adobe
brand in the name “adobe”lure words (login, verify, secure…) “billing”
Highadobereaders.xyzscore 55echoes adobe· empty page
brand in the name “adobe”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: looks like abuse (target: Adobe), confidence 86%. An opinion, not a finding.

Highama-zone777.clubscore 55echoes amazon· not probed yet
brand in the name “amazon”brand plus digits “ama-zone777”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Highamazom-servicecenter.topscore 55echoes amazon· empty page
one-letter brand typo “amazom≈amazon”lure words (login, verify, secure…) “service”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”

Model opinion: looks like abuse (target: Amazon), confidence 80%. An opinion, not a finding.

Highantbyanthropic.funscore 55echoes anthropic· blocked the probe
brand in the name “anthropic”TLD with a high abuse rate “fun”brand name and brand-styled page “anthropic”form on a brand-styled page “has_form”
Highanthropi.cyouscore 55echoes anthropic· no DNS
one-letter brand typo “anthropi≈anthropic”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highapple-id-lcloud.shopscore 55echoes apple· not probed yet
brand in the name “apple”lure words (login, verify, secure…) “id”brand name behind Cloudflare “cloudflare.com”
Highapple-id.autosscore 55echoes apple· empty page
brand in the name “apple”lure words (login, verify, secure…) “id”TLD with a high abuse rate “autos”

Model opinion: looks like abuse (target: Apple), confidence 72%. An opinion, not a finding.

Highapple-id.mobiscore 55echoes apple· boilerplate page
brand in the name “apple”lure words (login, verify, secure…) “id”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Apple), confidence 80%. An opinion, not a finding.

Highapple-id.skinscore 55echoes apple· empty page
brand in the name “apple”lure words (login, verify, secure…) “id”TLD with a high abuse rate “skin”brand name at a retail registrar “NameMart Pte. Ltd.”

Model opinion: looks like phishing (target: Apple), confidence 72%. An opinion, not a finding.

Highapple-usa-id.clickscore 55echoes apple· not probed yet
brand in the name “apple”lure words (login, verify, secure…) “id”TLD with a high abuse rate “click”brand name behind Cloudflare “cloudflare.com”
Highbarclaysiportalbanking.comscore 55echoes barclays
brand in the name “barclays”lure words (login, verify, secure…) “portal”brand name on a rarely-seen nameserver “nsgriddns.com”
Highbarclaysiportalhelpcentre.comscore 55echoes barclays
brand in the name “barclays”lure words (login, verify, secure…) “portal”brand name on a rarely-seen nameserver “nsgriddns.com”
Highbarclaysiportalsecurity.comscore 55echoes barclays
brand in the name “barclays”lure words (login, verify, secure…) “portal,security”brand name on a rarely-seen nameserver “nsgriddns.com”
Highbestbuypath.shopscore 55echoes bestbuy· registrar placeholder
brand in the name “bestbuy”brand in page title, not in the name “hostinger”identical page on many newborns “156 identical pages”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highbet9ja-mobile.orgscore 55echoes tmobile· registrar placeholder
one-letter brand typo “mobile≈tmobile”brand plus digits “bet9ja-mobile”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: looks like abuse (target: Bet9ja), confidence 72%. An opinion, not a finding.

Highbhs-mobile-first.xyzscore 55echoes tmobile· not probed yet
one-letter brand typo “mobile≈tmobile”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
Highbradesco-gerenciachatpj.digitalscore 55echoes bradesco· blocked the probe
brand in the name “bradesco”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “cloudflare”
Highbybitweb3.cloudscore 55echoes bybit· boilerplate page
brand in the name “bybit”brand plus digits “bybitweb3”brand name at a retail registrar “GoDaddy”identical page on many newborns “6217 identical pages”

Model opinion: looks like abuse (target: Bybit), confidence 72%. An opinion, not a finding.

Highcasesrewardsverizon.comscore 55echoes verizon
brand in the name “verizon”lure words (login, verify, secure…) “reward,rewards”brand name behind Cloudflare “cloudflare.com”
Highchatgptimage26.comscore 55echoes chatgpt
brand in the name “chatgpt”brand plus digits “chatgptimage26”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highclaim-icloud.comscore 55echoes icloud
brand in the name “icloud”lure words (login, verify, secure…) “claim”
Highcloudflareverification.comscore 55echoes cloudflare
brand in the name “cloudflare”lure words (login, verify, secure…) “verification”brand name behind Cloudflare “cloudflare.com”
Highcoin-base-support-crypto.livescore 55echoes coinbase· robots.txt denied
brand in the name “coinbase”lure words (login, verify, secure…) “support”many hyphens “3”
Highcoinbaseewallet.netscore 55echoes coinbase
brand in the name “coinbase”lure words (login, verify, secure…) “wallet”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
Highcostco-membership.comscore 55echoes costco
brand in the name “costco”lure words (login, verify, secure…) “member,members”
Highdeliveryinthebay.comscore 55echoes ebay
brand in the name “ebay”lure words (login, verify, secure…) “delivery”brand name behind Cloudflare “cloudflare.com”
Highdevice-security-trezor.comscore 55echoes trezor
brand in the name “trezor”lure words (login, verify, secure…) “security”brand name behind Cloudflare “cloudflare.com”
Highdichvutiktok.spacescore 55echoes tiktok· empty page
brand in the name “tiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”brand name and brand-styled page “tiktok”

Model opinion: looks like abuse (target: TikTok), confidence 70%. An opinion, not a finding.

Highdocusigning.helpscore 55echoes docusign· robots.txt denied
brand in the name “docusign”lure words (login, verify, secure…) “signin”free DNS provider “dnsowl.com”

Same data as JSON: /api/zone/risk?day=2026-11-06&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.