Flagged newborn domains, Monday, November 9, 2026
7,587 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
one-letter brand typo “tiktov≈tiktok”brand name at a retail registrar “OVH sas”
one-letter brand typo “bookings≈booking”brand name at a retail registrar “Atom.com Domains LLC”
one-letter brand typo “finance≈binance”brand name at a retail registrar “Name.com, Inc.”
one-letter brand typo “finance≈binance”brand name at a retail registrar “Name.com, Inc.”
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “walmast≈walmart”brand name at a retail registrar “Atom.com Domains LLC”
one-letter brand typo “wewhat≈wechat”TLD with a high abuse rate “top”
brand in the name “cashapp”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “wellsfcargo≈wellsfargo”brand name at a retail registrar “Name.com, Inc.”
one-letter brand typo “whatisapp≈whatsapp”brand name at a retail registrar “Dominet (HK) Limited”
brand in the name “icloud”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “portal”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
one-letter brand typo “mashapp≈cashapp”brand name behind Cloudflare “cloudflare.com”
page pushes urgent payment “Claim your Reward”brand in page title, not in the name “costco”
lure words (login, verify, secure…) “account,accounts”TLD with a high abuse rate “top”login form “has_form+login words”
one-letter brand typo “rakuzen≈rakuten”brand name behind Cloudflare “cloudflare.com”
one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”
lure words (login, verify, secure…) “login”TLD with a high abuse rate “sbs”brand in page title, not in the name “cloudflare”
one-letter brand typo “sterling≈starling”brand name on a rarely-seen nameserver “awsdns-11.org”
lure words (login, verify, secure…) “member,members”brand in page title, not in the name “tesla”
lure words (login, verify, secure…) “alert,alerts”brand in page title, not in the name “cloudflare”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “cloudflare”
punycode name “趣购阁 scripts=CJK”TLD with a high abuse rate “top”form submits over plain HTTP “http://xn--7n3a1is5t.top/”
brand in the name “itau”form on a brand-styled page “has_form”
punycode name “匯贏國際平台 scripts=CJK”random-looking name “H=4.12”TLD with a high abuse rate “top”
punycode name “匯贏國際官方 scripts=CJK”random-looking name “H=3.88”TLD with a high abuse rate “top”
punycode name “匯贏國際官網 scripts=CJK”random-looking name “H=3.88”TLD with a high abuse rate “top”
punycode name “京山盧比 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “阿梦集团 scripts=CJK”random-looking name “H=3.62”TLD with a high abuse rate “top”
punycode name “龙的故事 scripts=CJK”random-looking name “H=3.75”TLD with a high abuse rate “top”
punycode name “龍的故事 scripts=CJK”random-looking name “H=3.88”TLD with a high abuse rate “top”
punycode name “运动助手 scripts=CJK”random-looking name “H=3.81”TLD with a high abuse rate “xyz”
punycode name “表哥传媒 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “雪糕同學 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “雪糕同学 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “永利吃肉 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “汇赢国际平台 scripts=CJK”random-looking name “H=4.11”TLD with a high abuse rate “top”
punycode name “汇赢国际平台 scripts=CJK”random-looking name “H=4.11”TLD with a high abuse rate “xyz”
punycode name “顺门千秋 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “順門千秋 scripts=CJK”random-looking name “H=3.77”TLD with a high abuse rate “top”
punycode name “阿夢集團 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “阿宇大王 scripts=CJK”random-looking name “H=3.75”TLD with a high abuse rate “top”
punycode name “表哥傳媒 scripts=CJK”random-looking name “H=3.64”TLD with a high abuse rate “top”
punycode name “汇赢国际官网 scripts=CJK”random-looking name “H=3.78”TLD with a high abuse rate “top”
punycode name “汇赢国际官网 scripts=CJK”random-looking name “H=3.78”TLD with a high abuse rate “xyz”
punycode name “汇赢国际官方 scripts=CJK”random-looking name “H=4.01”TLD with a high abuse rate “top”
punycode name “汇赢国际官方 scripts=CJK”random-looking name “H=4.01”TLD with a high abuse rate “xyz”
TLD with a high abuse rate “fun”page impersonates a brand “Binance”
brand in page title, not in the name “hostinger”identical page on many newborns “42 identical pages”
brand in page title, not in the name “hostinger”identical page on many newborns “42 identical pages”
Same data as JSON: /api/zone/risk?day=2026-11-09&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.