brand in the name “lazada”TLD with a high abuse rate “lol”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: looks like abuse (target: Lazada), confidence 70%. An opinion, not a finding.
brand in the name “microsoft”brand plus digits “microsoft0”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “microsoft”TLD with a high abuse rate “homes”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
TLD with a high abuse rate “xyz”brand in page title, not in the name “google”form on a brand-styled page “has_form”form submits over plain HTTP “https://www.mimhotel.xyz”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
lure words (login, verify, secure…) “parcel”TLD with a high abuse rate “top”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
lure words (login, verify, secure…) “verify”TLD with a high abuse rate “click”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks like abuse (target: Poshmark), confidence 80%. An opinion, not a finding.
brand in the name “robinhood”brand plus digits “robinhoodi02”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “robinhood”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Nics Telekomunikasyon A.S.”
brand in the name “roblox”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
brand in the name “roblox”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Hosting Concepts B.V. d/b/a Registrar.eu”
brand in the name “icloud”TLD with a high abuse rate “bid”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “shopify”brand plus digits “shopify84”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “GoDaddy.com, LLC”
brand in the name “smbc”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “etsy”TLD with a high abuse rate “cfd”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
one-letter brand typo “starting≈starling”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”identical page on many newborns “4311 identical pages”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
lure words (login, verify, secure…) “prize”TLD with a high abuse rate “sbs”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: suspicious, confidence 62%. An opinion, not a finding.
brand in the name “tiktok”TLD with a high abuse rate “cyou”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: looks like abuse (target: TikTok), confidence 70%. An opinion, not a finding.
one-letter brand typo “tresor≈trezor”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “usaa”TLD with a high abuse rate “xyz”brand name on a rarely-seen nameserver “myclientserver.com”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.Ş.”
Highwinance.orgscore 52echoes binance· boilerplate page one-letter brand typo “winance≈binance”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “35 identical pages”
Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.
punycode name “小明cloud scripts=CJK/LATIN”one-letter brand typo “cloud≈icloud”brand name behind Cloudflare “cloudflare.com”
brand spelled with digits “1inkedin→linkedin”brand plus digits “1inkedin”brand name at a retail registrar “InterNetX GmbH”
brand spelled with digits “aw384y→ebay”brand plus digits “aw384y”TLD with a high abuse rate “top”
brand spelled with digits “e7syij→etsy”brand plus digits “e7syij”TLD with a high abuse rate “top”
brand in the name “whatsapp”brand name on a rarely-seen nameserver “longmingdns.com”brand name and brand-styled page “whatsapp”
Model opinion: looks like abuse (target: WhatsApp), confidence 80%. An opinion, not a finding.
brand in the name “linkedin”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “linkedin”
Model opinion: looks benign, confidence 75%. An opinion, not a finding.
brand spelled with digits “resellit4u→itau”brand plus digits “resellit4u”brand name at a retail registrar “GoDaddy.com, LLC”
brand spelled with digits “resellit4u→itau”brand plus digits “resellit4u”brand name at a retail registrar “GoDaddy.com LLC”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
brand in the name “shopify”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “shopify”
Model opinion: looks benign, confidence 45%. An opinion, not a finding.
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “roblox”
Model opinion: looks benign, confidence 93%. An opinion, not a finding.
brand in the name “whatsapp”brand name on a rarely-seen nameserver “longmingdns.com”brand name and brand-styled page “whatsapp”
Model opinion: suspicious (target: whatsapp), confidence 51%. An opinion, not a finding.
brand in the name “tiktok”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “tiktok”
Model opinion: looks benign, confidence 63%. An opinion, not a finding.
brand spelled with digits “u5psg→usps”brand plus digits “u5psg”TLD with a high abuse rate “buzz”
Model opinion: looks like abuse (target: USPS), confidence 60%. An opinion, not a finding.
very long name “43”TLD with a high abuse rate “cfd”brand in page title, not in the name “wordpress”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 66%. An opinion, not a finding.
brand in the name “xbox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “roblox”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
brand in the name “itau”brand name at a retail registrar “GoDaddy.com, LLC”brand in page title, not in the name “google”brand name redirects elsewhere “twupro.com”
Model opinion: looks benign, confidence 46%. An opinion, not a finding.
brand in the name “ebay”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
TLD with a high abuse rate “top”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”
Model opinion: suspicious, confidence 48%. An opinion, not a finding.
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “chatgpt”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
Model opinion: looks like abuse (target: OpenAI (ChatGPT)), confidence 75%. An opinion, not a finding.
one-letter brand typo “finance≈binance”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Ultahost, Inc.”
one-letter brand typo “cloud≈icloud”brand plus digits “cloud-app3201”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
one-letter brand typo “cloud≈icloud”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “disney”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
lure words (login, verify, secure…) “service,services”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”
brand in the name “ebay”brand in page title, not in the name “cloudflare”
Model opinion: looks benign, confidence 95%. An opinion, not a finding.
brand in the name “fidelity”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”brand name at a watch-list registrar “NameSilo, LLC”
brand in the name “google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”
brand in the name “google”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”