cdn-tg-cloud.icu
Appeared in the .icu zone on Friday, September 4, 2026; by the end of that day the census found empty page. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Bare JSON API response ({"message":"Server is running"}) with no site content — a backend/C2-style endpoint rather than a web page; the name pattern 'cdn-tg-cloud' on a cheap .icu via Gname behind Cloudflare fits Telegram-themed campaign infrastructure, but there is no visible impersonation or credential capture to judge yet (the scorer's cloud≈icloud match is weak).
Domain name cdn-tg-cloud.icu contains a brand-adjacent word (cloud≈icloud) and uses the .icu TLD with Cloudflare nameservers, matching a profile consistent with infrastructure setup for phishing or abuse. However, the page currently displays only a minimal JSON response ('Server is running') with no forms, content, or active impersonation visible. The infrastructure and naming suggest preparation for a phishing campaign, but without a live phishing page or form, the evidence is not yet conclusiv
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, September 4, 2026
Same data as JSON: /api/zone/domain/cdn-tg-cloud.icu. This page is not indexed by search engines and does not link to the site it describes.