brand in the name “tiktok”brand plus digits “tiktokslot4d”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Model opinion: looks like abuse (target: TikTok), confidence 72%. An opinion, not a finding.
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name on a rarely-seen nameserver “managedns.org”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name on a rarely-seen nameserver “packetra.com”
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”
brand in the name “uber”lure words (login, verify, secure…) “login”
brand in the name “robinhood”lure words (login, verify, secure…) “update”brand name behind Cloudflare “cloudflare.com”
brand in the name “amazon”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
brand in the name “usaa”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”+1 more
brand spelled with digits “usa4mation→usaa”brand plus digits “usa4mation”brand name at a retail registrar “HOSTINGER operations, UAB”brand name at a watch-list registrar “HOSTINGER operations, UAB”
brand in the name “vanguard”lure words (login, verify, secure…) “pay”
brand in the name “vanguard”lure words (login, verify, secure…) “service”
brand in the name “vanguard”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Model opinion: suspicious, confidence 55%. An opinion, not a finding.
brand in the name “vanguard”lure words (login, verify, secure…) “service,services”
brand in the name “vanguard”lure words (login, verify, secure…) “service”
brand in the name “amazon”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
brand in the name “wechat”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
brand in the name “wechat”brand plus digits “wechat2api”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “wellsfargo”lure words (login, verify, secure…) “secure”brand name on a rarely-seen nameserver “ndns.cn”
Model opinion: looks like abuse (target: Wells Fargo), confidence 82%. An opinion, not a finding.
one-letter brand typo “whatsaopp≈whatsapp”brand in page title, not in the name “cloudflare”form on a brand-styled page “has_form”
brand in the name “whatsapp”lure words (login, verify, secure…) “reset”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
brand in the name “whatsapp”lure words (login, verify, secure…) “reset”
brand in the name “wordpress”TLD with a high abuse rate “xyz”brand name and brand-styled page “wordpress”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 72%. An opinion, not a finding.
brand in the name “amazon”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”
Highwsapp13.comscore 55echoes apple· redirects elsewhere brand spelled with digits “wsapp13→apple”brand plus digits “wsapp13”brand in page title, not in the name “whatsapp”brand name redirects elsewhere “whatsapp.com”
Model opinion: suspicious, confidence 60%. An opinion, not a finding.
brand in the name “xbox”brand plus digits “xbox360gaoqingshipinxian”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “xbox”very long name “32”brand plus digits “xboxsanliulinggaoqingshipinxian1”brand name behind Cloudflare “cloudflare.com”+2 more
punycode name “comércio scripts=LATIN”brand in page title, not in the name “google”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 80%. An opinion, not a finding.
punycode name “instalacióndewordpress scripts=LATIN”brand in the name “wordpress”brand name at a retail registrar “Dattatec Corp”
punycode name “instalacióndewordpress scripts=LATIN”brand in the name “wordpress”brand name at a retail registrar “Dattatec Corp”
punycode name “instalacióndewordpress scripts=LATIN”brand in the name “wordpress”brand name at a retail registrar “Dattatec Corp”
one-letter brand typo “betflix≈netflix”brand plus digits “y2k-betflix”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
brand in the name “revolut”lure words (login, verify, secure…) “access”brand name at a retail registrar “Spaceship, Inc.”brand name at a watch-list registrar “Spaceship, Inc.”
one-letter brand typo “ahlipay≈alipay”lure words (login, verify, secure…) “pay”
brand in the name “ebay”lure words (login, verify, secure…) “service,services”brand name at a retail registrar “Tucows Domains Inc.”
brand in the name “bestbuy”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3242 identical pages”
Model opinion: looks like abuse (target: Best Buy), confidence 62%. An opinion, not a finding.
brand in the name “caixabank”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks like a scam (target: CaixaBank), confidence 88%. An opinion, not a finding.
brand in the name “caixabank”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: CaixaBank), confidence 80%. An opinion, not a finding.
brand in the name “caixabank”brand name behind Cloudflare “cloudflare.com”form on a brand-styled page “has_form”
Model opinion: looks like phishing (target: CaixaBank), confidence 85%. An opinion, not a finding.
brand in the name “chatgpt”brand plus digits “chatgpt68868”TLD with a high abuse rate “top”brand name at a retail registrar “West263 International Limited”
one-letter brand typo “lcloud≈icloud”TLD with a high abuse rate “xyz”brand name at a retail registrar “Atak Domain Bilgi Teknolojileri A.Ş.”identical page on many newborns “87 identical pages”
Model opinion: looks like abuse (target: Apple), confidence 80%. An opinion, not a finding.
one-letter brand typo “experia≈expedia”brand name at a retail registrar “Gandi SAS”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 90%. An opinion, not a finding.
one-letter brand typo “finance≈binance”brand plus digits “finance-v2”brand name at a retail registrar “Global Domain Group LLC”identical page on many newborns “702 identical pages”
Model opinion: suspicious, confidence 50%. An opinion, not a finding.
one-letter brand typo “finance≈binance”many hyphens “4”very long name “28”brand plus digits “finance-v3-prod-gateway-swap”+1 more
brand in the name “amazon”lure words (login, verify, secure…) “service”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
brand in the name “gmail”brand plus digits “gmailtool9s”TLD with a high abuse rate “click”brand name at a retail registrar “GMO Internet, Inc. d/b/a Onamae.com”
brand in the name “tiktok”lure words (login, verify, secure…) “account”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “tiktok”lure words (login, verify, secure…) “account”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”
brand in the name “hulu”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”identical page on many newborns “3242 identical pages”
Model opinion: looks benign, confidence 88%. An opinion, not a finding.
one-letter brand typo “mobile≈tmobile”brand name at a retail registrar “Regional Network Information Center, JSC”form on a brand-styled page “has_form”
Model opinion: looks benign, confidence 85%. An opinion, not a finding.
brand in the name “revolut”TLD with a high abuse rate “top”brand name on a rarely-seen nameserver “ec-dns.com”identical page on many newborns “20 identical pages”
Model opinion: looks like phishing (target: RevolutionRace (RVRC)), confidence 88%. An opinion, not a finding.