I ran into it this as well and the response from the folks running our block list said it triggered a "newly seen across all of OpenDNS" heuristic. This matches

I ran into it this as well and the response from the folks running our block list said it triggered a "newly seen across all of OpenDNS" heuristic. This matches other similar blocks I've seen for newly registered gTLD domains. Seems that this is the relevant documentation: https://support.umbrella.com/hc/en-us/articles/235911828-Newly-Seen-Domains-Security-Category https://support.umbrella.com/hc/en-us/articles/235911828-New...