Highscore 42 · flagged Saturday, September 26, 2026

baiyangxi.shop

Appeared in the .shop zone on Saturday, September 26, 2026; by the end of that day the census found active website about education. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Netflix
+22
brand in page title, not in the name
matched: netflix
+20
Registrar
—
Nameserver provider
Nameservers
gemma.ns.cloudflare.com, pedro.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
白羊星机场 - 高速稳定全球网络加速与 AI/流媒体订阅方案
Has a form
no
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 70%· claude-opus-5-5

The page is a Chinese proxy/VPN subscription ('机场') landing page, branded 白羊星机场, which matches the domain name baiyangxi. Netflix, ChatGPT and Disney+ appear only as services it claims to unlock, with no brand logos and no form. The register links point to affiliate proxy providers (flycatvipaff.cc, tizicloud), which makes this an affiliate funnel for circumvention services, not impersonation or credential capture.

First passsuspicioustarget: Netflixconfidence 65%· claude-haiku-4-5

The page mentions Netflix as a streaming service that can be unlocked via their network acceleration service, but does not impersonate Netflix's login, portal, or branding. The scorer flagged 'brand-impersonation' and 'netflix' in title, but the page is a VPN/proxy service (Aries 机场) advertising access to streaming platforms rather than pretending to be Netflix itself. The mention of Netflix appears to be a feature claim (unlocking geoblocked content) rather than credential harvesting, making th

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Saturday, September 26, 2026

Screenshot of baiyangxi.shop taken by the zone census on 2026-09-26

Same data as JSON: /api/zone/domain/baiyangxi.shop. This page is not indexed by search engines and does not link to the site it describes.