Flagged newborn domains, Friday, November 6, 2026
12,218 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “很留重再业 scripts=CJK”random-looking name “H=3.79”
punycode name “完鸡陷积干坐习 scripts=CJK”random-looking name “H=4.13”
punycode name “서민대출 scripts=HANGUL”random-looking name “H=3.64”
punycode name “购尾附群们花院 scripts=CJK”random-looking name “H=4.18”
punycode name “图腾机柜 scripts=CJK”random-looking name “H=3.62”
punycode name “黎乡淘 scripts=CJK”random-looking name “H=3.70”
punycode name “南方水产网 scripts=CJK”random-looking name “H=3.85”
punycode name “状冲产淫何 scripts=CJK”random-looking name “H=3.85”
punycode name “今饿漆刃夏抢忙 scripts=CJK”random-looking name “H=3.97”
punycode name “象较流而资度请 scripts=CJK”random-looking name “H=3.77”
punycode name “wykrywanieprzeciekowgdańsk scripts=LATIN”random-looking name “H=3.77”
punycode name “코다리넘버원 scripts=HANGUL”random-looking name “H=3.78”
punycode name “东站据输几攒 scripts=CJK”random-looking name “H=3.69”
punycode name “恨妻常东表珍刃 scripts=CJK”random-looking name “H=4.05”
punycode name “海办运最介 scripts=CJK”random-looking name “H=3.79”
punycode name “外敢哲过回地笔 scripts=CJK”random-looking name “H=3.89”
punycode name “犯浩老入如喜孩 scripts=CJK”random-looking name “H=3.91”
punycode name “奶昔加速官网 scripts=CJK”random-looking name “H=3.63”
punycode name “奶昔加速官网 scripts=CJK”random-looking name “H=3.63”
punycode name “方元建筑 scripts=CJK”random-looking name “H=3.64”
punycode name “보험전문변호사 scripts=HANGUL”random-looking name “H=4.18”
punycode name “창문청소 scripts=HANGUL”random-looking name “H=3.77”
punycode name “박물관도메인 scripts=HANGUL”random-looking name “H=3.85”
punycode name “是余分落爱给电 scripts=CJK”random-looking name “H=4.08”
punycode name “剩余电流继电器 scripts=CJK”random-looking name “H=3.89”
punycode name “失害连穿救搞 scripts=CJK”random-looking name “H=3.64”
punycode name “영원통신 scripts=HANGUL”random-looking name “H=3.77”
page impersonates a brand “Office 365”
page impersonates a brand “Coinbase”
page impersonates a brand “Microsoft 365”
page impersonates a brand “Microsoft 365”
TLD with a high abuse rate “top”page pushes urgent payment “risk-free”
page impersonates a brand “Microsoft 365”
page impersonates a brand “PAYPAL”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “Coinbase”
page impersonates a brand “Microsoft 365”
TLD with a high abuse rate “top”login form “has_form+login words”
page impersonates a brand “Netflix”
page impersonates a brand “IRS”
page impersonates a brand “IRS”
page impersonates a brand “IRs”
page impersonates a brand “USPS”
lure words (login, verify, secure…) “auth,portal”many hyphens “4”very long name “35”
page impersonates a brand “Binance”
page impersonates a brand “IRS”
TLD with a high abuse rate “buzz”login form “has_form+login words”
TLD with a high abuse rate “win”login form “has_form+login words”
Same data as JSON: /api/zone/risk?day=2026-11-06&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.