one-letter brand typo “lcloud≈icloud”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “shopifiy≈shopify”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name on a rarely-seen nameserver “novareon.net”
brand in the name “whatsapp”lure words (login, verify, secure…) “access”
brand in the name “walmart”lure words (login, verify, secure…) “portal”
punycode name “türkifsatelegram scripts=LATIN”brand in the name “telegram”brand name at a retail registrar “Nics Telekomunikasyon A.S.”
one-letter brand typo “finance≈binance”lure words (login, verify, secure…) “limited”
Higharamed.xyzscore 54echoes aramex· boilerplate page one-letter brand typo “aramed≈aramex”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “6217 identical pages”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
lure words (login, verify, secure…) “confirm,confirmation”very long name “35”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
lure words (login, verify, secure…) “alert,alerts”page impersonates a brand “Binance”brand in page title, not in the name “telegram”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
one-letter brand typo “cooking≈booking”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “fedex”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”identical page on many newborns “190 identical pages”
Model opinion: looks like abuse (target: FedEx), confidence 80%. An opinion, not a finding.
brand in the name “tiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “28 identical pages”
Model opinion: looks like abuse (target: TikTok), confidence 80%. An opinion, not a finding.
brand in the name “hulu”brand plus digits “hulushipin-h5”TLD with a high abuse rate “lol”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “hulu”brand plus digits “huluyingyuan-h5”TLD with a high abuse rate “lol”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
one-letter brand typo “ledgerx≈ledger”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “6217 identical pages”
Model opinion: looks benign, confidence 66%. An opinion, not a finding.
brand in the name “sendgrid”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “shopify”many hyphens “4”very long name “31”brand name behind Cloudflare “cloudflare.com”+1 more
brand in the name “navyfederal”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”identical page on many newborns “30 identical pages”
Model opinion: looks like abuse (target: Navy Federal Credit Union), confidence 85%. An opinion, not a finding.
brand in the name “bradesco”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Sav.com, LLC”brand name at a watch-list registrar “Sav.com, LLC”+1 more
Highnfinity.xyzscore 54echoes xfinity· boilerplate page one-letter brand typo “nfinity≈xfinity”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “6217 identical pages”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand name at a retail registrar “Gransy, s.r.o.”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 60%. An opinion, not a finding.
one-letter brand typo “openses≈opensea”brand name behind Cloudflare “cloudflare.com”brand in page title, not in the name “amazon”
Model opinion: looks benign, confidence 62%. An opinion, not a finding.
brand in the name “outlook”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
brand in the name “revolut”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “2484 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “revolut”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”identical page on many newborns “2484 identical pages”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “tiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3638 identical pages”
one-letter brand typo “cloud≈icloud”many hyphens “3”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
one-letter brand typo “strike≈stripe”many hyphens “4”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Highstribe.xyzscore 54echoes stripe· boilerplate page one-letter brand typo “stribe≈stripe”TLD with a high abuse rate “xyz”brand name at a retail registrar “GoDaddy.com, LLC”identical page on many newborns “6217 identical pages”
Model opinion: looks benign, confidence 68%. An opinion, not a finding.
brand in the name “taobao”brand plus digits “taobao168”TLD with a high abuse rate “fun”brand name at a retail registrar “Chengdu West Dimension Digital Technolog”
brand in the name “unicredit”brand name on a rarely-seen nameserver “radns.net”brand name at a retail registrar “OwnRegistrar, Inc.”identical page on many newborns “21 identical pages”
Model opinion: looks like abuse (target: UniCredit), confidence 80%. An opinion, not a finding.
brand in the name “binance”lure words (login, verify, secure…) “claim”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Eranet International Limited”
brand in the name “etsy”brand name at a retail registrar “Nhan Hoa Software Company Ltd”brand name and brand-styled page “etsy”
Model opinion: looks benign, confidence 62%. An opinion, not a finding.
brand in the name “starlink”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “starlink”
Model opinion: looks benign, confidence 65%. An opinion, not a finding.
brand in the name “apple”brand plus digits “128374-apple”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
brand in the name “coinbase”brand plus digits “157778-coinbase”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
brand in the name “coinbase”brand plus digits “394834-coinbase”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “PDR Ltd. d/b/a PublicDomainRegistry.com”
High5cloud.xyzscore 52echoes icloud· not probed yet one-letter brand typo “5cloud≈icloud”brand plus digits “5cloud”TLD with a high abuse rate “xyz”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “gmail”brand plus digits “650gmail”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
High6cloud.xyzscore 52echoes icloud· not probed yet one-letter brand typo “6cloud≈icloud”brand plus digits “6cloud”TLD with a high abuse rate “xyz”brand name at a retail registrar “GMO Internet Group, Inc. d/b/a Onamae.co”
brand in the name “fidelity”brand plus digits “7oakfidelity”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “gmail”brand plus digits “adiya073gmail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “bankofamerica”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “bybit”brand plus digits “bybit857”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Model opinion: looks like a scam (target: Bybit), confidence 80%. An opinion, not a finding.
brand in the name “paypal”TLD with a high abuse rate “icu”brand name at a retail registrar “Web Commerce Communications Limited dba ”brand name at a watch-list registrar “Web Commerce Communications Limited dba ”
brand in the name “paypal”TLD with a high abuse rate “quest”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “URL Solutions, Inc.”
brand in the name “chatgpt”TLD with a high abuse rate “xyz”brand name on a rarely-seen nameserver “regexdomain.com”brand name at a retail registrar “Global Domain Group LLC”
Model opinion: looks like abuse (target: OpenAI (ChatGPT)), confidence 80%. An opinion, not a finding.
brand in the name “telegram”brand plus digits “ck444telegram”TLD with a high abuse rate “cam”brand name behind Cloudflare “cloudflare.com”
brand in the name “xbox”TLD with a high abuse rate “work”brand name at a retail registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”brand name at a watch-list registrar “Alibaba Cloud Computing Ltd. d/b/a HiChi”
Model opinion: looks benign, confidence 47%. An opinion, not a finding.