Flagged newborn domains, Friday, November 13, 2026
10,834 names at tier low or above, highest score first.
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
page impersonates a brand “PayPal”
brand in the name “etsy”TLD with a high abuse rate “hair”
TLD with a high abuse rate “bond”page pushes urgent payment “Claim Your Bonus”
page impersonates a brand “Netflix”
page impersonates a brand “Netflix”
page impersonates a brand “DHL”
page impersonates a brand “HMRC”
page impersonates a brand “MetaMask”
TLD with a high abuse rate “xyz”login form “has_form+login words”
page impersonates a brand “PayPal”
ambiguous brand word “tesla”TLD with a high abuse rate “fun”identical page on many newborns “94 identical pages”
page impersonates a brand “Binance”
page impersonates a brand “PayPal”
page impersonates a brand “Paypal”
page impersonates a brand “PayPal”
page impersonates a brand “Apple ID”
page impersonates a brand “Binance”
page impersonates a brand “PayPal”
free DNS provider “dnsowl.com”page pushes urgent payment “risk-free”
page impersonates a brand “PayPal”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
lure words (login, verify, secure…) “login,service”many hyphens “5”very long name “40”
page impersonates a brand “PayPal”
brand in the name “vanguard”brand name redirects elsewhere “l.ink”
lure words (login, verify, secure…) “update”TLD with a high abuse rate “top”free DNS provider “dnsowl.com”
page impersonates a brand “PayPal”
TLD with a high abuse rate “work”page pushes urgent payment “ACT Now”
page impersonates a brand “Netflix”
page impersonates a brand “PayPal”
page impersonates a brand “PayPal”
brand in the name “amazon”brand name redirects elsewhere “l.ink”
brand in the name “gmail”brand name at a retail registrar “GoDaddy.com, LLC”
punycode name “จ้างที่ปรึกษากฎหมาย scripts=THAI”very long name “36”
punycode name “서수원제일풍경채 scripts=HANGUL”very long name “30”
punycode name “경기도시흥도어락 scripts=HANGUL”very long name “29”
punycode name “수원데이터복구센터 scripts=HANGUL”very long name “32”
punycode name “압구정명당부동산 scripts=HANGUL”very long name “29”
punycode name “인천휴대폰성지산곡 scripts=HANGUL”very long name “32”
punycode name “贾王国人民币永久霸权全球市场 scripts=CJK”very long name “48”
punycode name “советскоесоевоемасло scripts=CYRILLIC”very long name “28”
punycode name “советскоесоевоемасло scripts=CYRILLIC”very long name “28”
punycode name “에코금강펜테리움 scripts=HANGUL”very long name “30”
punycode name “abschleppdienstmörfeldengmbh scripts=LAT”very long name “28”
punycode name “estudiodiseñograficoasturias scripts=LAT”very long name “28”
punycode name “中国野生动物训养殖基地 scripts=CJK”very long name “38”
punycode name “全球竹产品义乌选品中心 scripts=CJK”very long name “36”
punycode name “中国文化数字资产 scripts=CJK”very long name “28”
punycode name “中國文化數字資產 scripts=CJK”very long name “29”
punycode name “સંતોષલાલાંગીસસંલાલાં scripts=GUJARATI”very long name “33”
Same data as JSON: /api/zone/risk?day=2026-11-13&tier=low. Screenshots and the model's reasoning are on each domain's evidence page.