Flagged newborn domains, Monday, November 9, 2026

23 names at tier critical or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalonre-finance.cfdscore 82echoes binance· active website
one-letter brand typo “finance≈binance”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”page impersonates a brand “Binance”+1 more

Model opinion: looks like abuse (target: OnRe), confidence 60%. An opinion, not a finding.

Criticalplaystation1.topscore 79echoes playstation· active website
brand in the name “playstation”brand plus digits “playstation1”TLD with a high abuse rate “top”brand name and brand-styled page “playstation”+1 more

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalplaystation2.topscore 79echoes playstation· active website
brand in the name “playstation”brand plus digits “playstation2”TLD with a high abuse rate “top”brand name and brand-styled page “playstation”+1 more

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticaladobeclientupdater.orgscore 77echoes adobe· active website
brand in the name “adobe”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”brand name and brand-styled page “adobe”

Model opinion: looks like abuse (target: Adobe), confidence 90%. An opinion, not a finding.

Criticalbarclaysiportalpayments.comscore 74echoes barclays· active website
brand in the name “barclays”lure words (login, verify, secure…) “payment,payments,portal”brand name on a rarely-seen nameserver “nsgriddns.com”

Model opinion: looks like abuse (target: Barclays), confidence 80%. An opinion, not a finding.

Criticalplaystationvita.topscore 71echoes playstation· active website
brand in the name “playstation”TLD with a high abuse rate “top”brand name and brand-styled page “playstation”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 82%. An opinion, not a finding.

Critical6-trustwallet.comscore 70echoes trustwallet· active website
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand plus digits “6-trustwallet”brand name behind Cloudflare “cloudflare.com”

Model opinion: looks like abuse (target: Trust Wallet), confidence 75%. An opinion, not a finding.

Criticalroblox-scripts.xyzscore 67echoes roblox· active website
brand in the name “roblox”TLD with a high abuse rate “xyz”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”+1 more

Model opinion: looks like abuse, confidence 78%. An opinion, not a finding.

Criticalshuafen.bizscore 66· active website
page asks for credentials “log in to your account”page impersonates a brand “PayPal”login form “has_form+login words”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Criticaldisneyonicemanilaph.livescore 65echoes disney· active website
brand in the name “disney”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”brand name at a watch-list registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more

Model opinion: looks like phishing (target: Disney On Ice (Feld Entertainment / Disney)), confidence 90%. An opinion, not a finding.

Criticalverizonsolutions.agencyscore 63echoes verizon· active website
brand in the name “verizon”brand name and brand-styled page “verizon”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Verizon), confidence 68%. An opinion, not a finding.

Criticalaccount-store.xyzscore 62· active website
lure words (login, verify, secure…) “account,accounts”TLD with a high abuse rate “xyz”page impersonates a brand “Netflix”brand in page title, not in the name “apple”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticalinstatelegram.topscore 62echoes telegram· active website
brand in the name “telegram”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 88%. An opinion, not a finding.

Criticalroyalmailtracking.orgscore 62echoes royalmail· active website
brand in the name “royalmail”lure words (login, verify, secure…) “track,tracking”

Model opinion: looks like abuse (target: Royal Mail), confidence 82%. An opinion, not a finding.

Criticalbenchread.appscore 60· active website
page impersonates a brand “IRS”brand in page title, not in the name “microsoft”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Criticalclaim-rewards-eua.onlinescore 60· active website
lure words (login, verify, secure…) “claim,reward,rewards”page impersonates a brand “PayPal”brand in page title, not in the name “paypal”

Model opinion: looks like phishing (target: YouTube), confidence 72%. An opinion, not a finding.

Criticalcqc-consulting.netscore 60· active website
page impersonates a brand “Binance”brand in page title, not in the name “linkedin”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 80%. An opinion, not a finding.

Criticallazadatotozeus4.lolscore 60echoes lazada· active website
brand in the name “lazada”brand plus digits “lazadatotozeus4”TLD with a high abuse rate “lol”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: looks like abuse (target: Lazada), confidence 75%. An opinion, not a finding.

Criticalopenapi.casascore 60echoes openai· active website
one-letter brand typo “openapi≈openai”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Criticalpagepartner.topscore 60· active website
TLD with a high abuse rate “top”page pushes urgent payment “Claim your reward”brand in page title, not in the name “facebook”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Facebook), confidence 82%. An opinion, not a finding.

Criticalreelist.appscore 60· active website
page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Criticalshopif.topscore 60echoes shopify· active website
one-letter brand typo “shopif≈shopify”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “hostiq.ua”form on a brand-styled page “has_form”

Model opinion: looks like abuse (target: Shopify), confidence 55%. An opinion, not a finding.

Criticalstormstrailsandtails.comscore 60· active website
page impersonates a brand “Amazon Prime”brand in page title, not in the name “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 88%. An opinion, not a finding.

Same data as JSON: /api/zone/risk?day=2026-11-09&tier=critical. Screenshots and the model's reasoning are on each domain's evidence page.