Flagged newborn domains, Tuesday, November 10, 2026
10,133 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
punycode name “지지벳입장 scripts=HANGUL”random-looking name “H=3.64”
punycode name “张夫我镜膺屋 scripts=CJK”random-looking name “H=3.91”
punycode name “풀빠따최신주소 scripts=HANGUL”random-looking name “H=4.08”
punycode name “차이행정사사무소 scripts=HANGUL”random-looking name “H=3.65”
punycode name “행정사사무소채움 scripts=HANGUL”random-looking name “H=3.97”
punycode name “음주운전법무법인 scripts=HANGUL”random-looking name “H=4.02”
punycode name “이진희과학학원 scripts=HANGUL”random-looking name “H=3.86”
punycode name “没铮瓶父惊对国 scripts=CJK”random-looking name “H=3.82”
punycode name “사우센토피아 scripts=HANGUL”random-looking name “H=4.17”
punycode name “美特管业 scripts=CJK”random-looking name “H=3.64”
punycode name “中国老龄产业 scripts=CJK”random-looking name “H=3.92”
punycode name “胜丰肥业 scripts=CJK”random-looking name “H=3.66”
punycode name “호반써밋초량 scripts=HANGUL”random-looking name “H=3.75”
punycode name “蹈笑特玉砚 scripts=CJK”random-looking name “H=3.69”
punycode name “辽宁京东电商 scripts=CJK”random-looking name “H=4.01”
punycode name “开元国际 scripts=CJK”random-looking name “H=3.77”
punycode name “산타입장 scripts=HANGUL”random-looking name “H=3.64”
punycode name “지식산업센터 scripts=HANGUL”random-looking name “H=4.12”
punycode name “웰에이징센터 scripts=HANGUL”random-looking name “H=4.02”
punycode name “童寝震仰眉眼印 scripts=CJK”random-looking name “H=4.02”
punycode name “挺灭佼将慨锋 scripts=CJK”random-looking name “H=4.18”
punycode name “失眠治理 scripts=CJK”random-looking name “H=3.64”
punycode name “重庆铱格 scripts=CJK”random-looking name “H=3.91”
TLD with a high abuse rate “xyz”login form “has_form+login words”
brand in the name “revolut”brand plus digits “1764basquerevolution”
brand in the name “stripe”brand plus digits “3stripesireland”
brand in the name “ebay”brand plus digits “748nebayisle”
lure words (login, verify, secure…) “account,customer,customers,service”very long name “31”
lure words (login, verify, secure…) “account,customer,customers,service”very long name “32”
lure words (login, verify, secure…) “support”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “IRS”
page impersonates a brand “Coinbase”
TLD with a high abuse rate “click”login form “has_form+login words”
brand in the name “anthropic”lure words (login, verify, secure…) “account”brand name behind Cloudflare “cloudflare.com”brand's own corporate registrar (reduces score) “MarkMonitor Inc.”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
free DNS provider “dnsowl.com”page pushes urgent payment “RISK-FREE”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
page impersonates a brand “DHL”
brand in the name “etsy”brand plus digits “betsyk2100”
page impersonates a brand “BINANCE”
TLD with a high abuse rate “sbs”login form “has_form+login words”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
page impersonates a brand “Binance”
Same data as JSON: /api/zone/risk?day=2026-11-10&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.