candytallyun.monster
Appeared in the .monster zone on Monday, September 28, 2026; by the end of that day the census found active website about ai software. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page is a Chinese 'airport' (VPN/proxy) promo for its own brand, 糖果云 CandyYun, with its own pricing (¥12/¥35 per month) and no login or payment form. Netflix, YouTube, Spotify and ChatGPT appear only as services the proxy claims to unlock, not as impersonated brands, so the scorer's Netflix hit is a false positive. The throwaway .monster name and the 'more airport recommendations' affiliate framing are low-grade signals, not evidence of deception.
CandyYun is a VPN/proxy service (机场 = 'airport', slang for VPN proxy provider) marketing itself as enabling access to georestricted streaming services like Netflix, YouTube, and ChatGPT. While the page mentions Netflix, it is not impersonating Netflix—it is selling its own VPN service and explicitly lists Netflix as one of many platforms users can access through it. This is an unlicensed circumvention/proxy service operating under its own brand, which constitutes abuse rather than phishing.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
Same data as JSON: /api/zone/domain/candytallyun.monster. This page is not indexed by search engines and does not link to the site it describes.