Flagged newborn domains, Thursday, November 12, 2026

3,810 names at tier medium or above, highest score first.

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Highlinee.homesscore 55echoes lineme· robots.txt denied
one-letter brand typo “linee≈lineme”TLD with a high abuse rate “homes”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Highlink-mobile-jun88.comscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “link-mobile-jun88”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highlinkedin-dueinvoicecom.comscore 55echoes linkedin
brand in the name “linkedin”lure words (login, verify, secure…) “invoice”
Highlinkedln9mail.comscore 55echoes gmail
brand spelled with digits “linkedln9mail→gmail”brand plus digits “linkedln9mail”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Highlogin-sparkasse.infoscore 55echoes sparkasse· not probed yet
brand in the name “sparkasse”lure words (login, verify, secure…) “login”brand name behind Cloudflare “cloudflare.com”
Highmicr0s0ftdocumentonelinedrive.cloudscore 55echoes microsoft· robots.txt denied
brand spelled with digits “micr0s0ftdocumentonelinedrive→microsoft”very long name “29”brand plus digits “micr0s0ftdocumentonelinedrive”free DNS provider “dnsowl.com”+2 more
Highmicrosoft-login.cloudscore 55echoes microsoft· excluded
brand in the name “microsoft”lure words (login, verify, secure…) “login”

Model opinion: looks like abuse (target: Microsoft), confidence 82%. An opinion, not a finding.

Highmicroxoft.cfdscore 55echoes microsoft· blocked the probe
one-letter brand typo “microxoft≈microsoft”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highmiracleoutlookfamilyservices.comscore 55echoes outlook
brand in the name “outlook”lure words (login, verify, secure…) “service,services”very long name “28”brand name at a retail registrar “NameCheap, Inc.”+1 more
Highmos011-mobile.netscore 55echoes tmobile
one-letter brand typo “mobile≈tmobile”brand plus digits “mos011-mobile”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Highmsct-finance.proscore 55echoes binance· registrar placeholder
one-letter brand typo “finance≈binance”form on a brand-styled page “has_form”identical page on many newborns “1453 identical pages”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highmsct-finance.solutionsscore 55echoes binance· registrar placeholder
one-letter brand typo “finance≈binance”form on a brand-styled page “has_form”identical page on many newborns “1453 identical pages”

Model opinion: looks benign, confidence 90%. An opinion, not a finding.

Highmydocs-overview-54958549he73y-movisafe-my-sharepoint.orgscore 55echoes sharepoint· not probed yet
brand in the name “sharepoint”many hyphens “5”very long name “52”brand plus digits “mydocs-overview-54958549he73y-movisafe-m”+3 more
Highnetgo-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 70%. An opinion, not a finding.

Highnexus-cloud-drive.sitescore 55echoes icloud· empty page
one-letter brand typo “cloud≈icloud”brand name at a retail registrar “Porkbun LLC”brand name at a watch-list registrar “Porkbun LLC”form on a brand-styled page “has_form”

Model opinion: suspicious, confidence 55%. An opinion, not a finding.

Highopenai-integration-api-v4.comscore 55echoes openai
brand in the name “openai”many hyphens “3”brand plus digits “openai-integration-api-v4”brand name at a retail registrar “NameCheap, Inc.”+1 more
Highopenairsecurityscreens.comscore 55echoes openai
brand in the name “openai”lure words (login, verify, secure…) “security”free DNS provider “dnsowl.com”
Highoutlook-secure.comscore 55echoes outlook
brand in the name “outlook”lure words (login, verify, secure…) “secure”brand name on a rarely-seen nameserver “awsdns-23.net”
Highparcelvanguard.orgscore 55echoes vanguard· boilerplate page
brand in the name “vanguard”lure words (login, verify, secure…) “parcel”identical page on many newborns “2096 identical pages”

Model opinion: looks benign, confidence 60%. An opinion, not a finding.

Highphantom-portal.comscore 55echoes phantom
brand in the name “phantom”lure words (login, verify, secure…) “portal”
Highpl-xbox-series-x-1tb.cfdscore 55echoes xbox· redirects elsewhere
brand in the name “xbox”many hyphens “4”brand plus digits “pl-xbox-series-x-1tb”TLD with a high abuse rate “cfd”+4 more

Model opinion: looks like abuse (target: Microsoft (Xbox)), confidence 72%. An opinion, not a finding.

Highpl-xbox-series-x.cfdscore 55echoes xbox· no web server
brand in the name “xbox”many hyphens “3”TLD with a high abuse rate “cfd”brand name behind Cloudflare “cloudflare.com”+1 more
Highplaystationofficial.comscore 55echoes playstation
brand in the name “playstation”lure words (login, verify, secure…) “official”
Highpocoloco-lucky-strike.funscore 55echoes stripe· boilerplate page
one-letter brand typo “strike≈stripe”TLD with a high abuse rate “fun”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Highportals-sendgrld.comscore 55echoes sendgrid
one-letter brand typo “sendgrld≈sendgrid”lure words (login, verify, secure…) “portal”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dominet (HK) Limited”
Highpro15team.picsscore 55echoes steam· not probed yet
brand spelled with digits “pro15team→steam”brand plus digits “pro15team”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”
Highproducts-cloud.icuscore 55echoes icloud· not probed yet
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “icu”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Highreadygo-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 75%. An opinion, not a finding.

Highrobinhood-87443.comscore 55echoes robinhood
brand in the name “robinhood”brand plus digits “robinhood-87443”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+1 more
Highs3b4y.topscore 55echoes ebay· no DNS
brand spelled with digits “s3b4y→ebay”brand plus digits “s3b4y”TLD with a high abuse rate “top”brand name at a retail registrar “NameMart Pte. Ltd.”
Highsafeguardverifytelegram.comscore 55echoes telegram
brand in the name “telegram”lure words (login, verify, secure…) “verify”brand name behind Cloudflare “cloudflare.com”
Highsecure-chase-login.comscore 55echoes chase
brand in the name “chase”lure words (login, verify, secure…) “login,secure”brand name behind Cloudflare “cloudflare.com”
Highsendgo-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 70%. An opinion, not a finding.

Highsevelune-finance-fr.sbsscore 55echoes binance· not probed yet
one-letter brand typo “finance≈binance”TLD with a high abuse rate “sbs”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Highshopeee.sbsscore 55echoes shopee· no web server
brand in the name “shopee”TLD with a high abuse rate “sbs”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Highshopeeku.sitescore 55echoes shopee· parked, for sale
brand in the name “shopee”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more
Highsmooth-whatsapp.comscore 55echoes whatsapp· redirects elsewhere
brand in the name “whatsapp”form on a brand-styled page “has_form”brand name redirects elsewhere “yahoo.com”

Model opinion: looks like abuse (target: WhatsApp), confidence 65%. An opinion, not a finding.

Highspotify-officials.comscore 55echoes spotify
brand in the name “spotify”lure words (login, verify, secure…) “official”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Cloudflare, Inc.”
Highspotifysupport.orgscore 55echoes spotify· boilerplate page
brand in the name “spotify”lure words (login, verify, secure…) “support”identical page on many newborns “2096 identical pages”

Model opinion: looks like abuse (target: Spotify), confidence 70%. An opinion, not a finding.

Hightax-coinbase.digitalscore 55echoes coinbase· no DNS
brand in the name “coinbase”lure words (login, verify, secure…) “tax”brand name behind Cloudflare “cloudflare.com”
Hightelegram-er.orgscore 55echoes telegram· redirects elsewhere
brand in the name “telegram”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”brand name at a watch-list registrar “Dynadot Inc”+1 more

Model opinion: looks like abuse (target: Telegram), confidence 70%. An opinion, not a finding.

Hightelegramgrupos.orgscore 55echoes telegram· redirects elsewhere
brand in the name “telegram”brand name and brand-styled page “telegram”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 70%. An opinion, not a finding.

Highthepiratebay.skinscore 55echoes ebay· not probed yet
brand in the name “ebay”TLD with a high abuse rate “skin”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Hightiktok59.comscore 55echoes tiktok
brand in the name “tiktok”brand plus digits “tiktok59”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Spaceship, Inc.”+1 more
Hightiktokmedia.lolscore 55echoes tiktok· not probed yet
brand in the name “tiktok”TLD with a high abuse rate “lol”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Hightioricojuegos.funscore 55· registrar placeholder
TLD with a high abuse rate “fun”brand in page title, not in the name “hostinger”form on a brand-styled page “has_form”identical page on many newborns “70 identical pages”

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Hightomobile.xyzscore 55echoes tmobile· robots.txt denied
one-letter brand typo “tomobile≈tmobile”TLD with a high abuse rate “xyz”free DNS provider “dnsowl.com”brand name at a retail registrar “NameSilo, LLC”+1 more
Hightrackamazonprices.comscore 55echoes amazon· not probed yet
brand in the name “amazon”lure words (login, verify, secure…) “track”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot3 LLC”+1 more
Hightrustwallet.solutionsscore 55echoes trustwallet· no DNS
brand in the name “trustwallet”lure words (login, verify, secure…) “wallet”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more
Highu888v4.comscore 55echoes bbva
brand spelled with digits “u888v4→bbva”brand plus digits “u888v4”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+1 more

Same data as JSON: /api/zone/risk?day=2026-11-12&tier=medium. Screenshots and the model's reasoning are on each domain's evidence page.