Criticalscore 68 · flagged Wednesday, October 21, 2026

bbyvpn.homes

Appeared in the .homes zone on Wednesday, October 21, 2026; by the end of that day the census found active website about education. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: homes
+8
page impersonates a brand
matched: Netflix
+22
brand in page title, not in the name
matched: netflix
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
holly.ns.cloudflare.com, jasper.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
宝贝云 (BabyCloud) 官方网站 - 极速专线 | 130+ 节点 | 2000 Mbps | 500 Gib/月
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 72%· claude-opus-5-5

The page is a Chinese proxy/VPN ('airport') landing page under its own brand, 宝贝云 (BabyCloud), matching the bby- name. Netflix, YouTube and Disney+ appear only as services it claims to unlock, so the scorer's Netflix hit is a false positive. The GET form with an example-name placeholder and the affiliate-style links to lingdongaff.com point to a sign-up funnel, not credential capture.

First passlooks like abuseconfidence 85%· claude-haiku-4-5

BabyCloud is a VPN service marketing itself under its own brand (宝贝云) with its own branding, logo, and business model. While the page mentions Netflix/Disney+ as content it can unlock, this is a legitimate VPN's value proposition, not impersonation. The domain and infrastructure appear to be a VPN service operator, not a phishing site. However, the service is likely an unlicensed circumvention tool marketed to bypass geo-restrictions, which constitutes abuse rather than phishing or benign use.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Wednesday, October 21, 2026

Screenshot of bbyvpn.homes taken by the zone census on 2026-10-21

Same data as JSON: /api/zone/domain/bbyvpn.homes. This page is not indexed by search engines and does not link to the site it describes.