cdn-ws-cloud.icu
Appeared in the .icu zone on Friday, September 4, 2026; by the end of that day the census found active website. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Serves only a default Chinese aaPanel/BT-panel 'site created successfully' index.html with no content, forms or links; the generic infrastructure-style name (cdn-ws-cloud) on a cheap .icu via Gname behind Cloudflare fits freshly-staged campaign/C2 infrastructure, but the 'cloud≈icloud' brand match is weak and there is no impersonation yet to judge.
The domain name cdn-ws-cloud.icu contains 'cloud' which is phonetically similar to 'icloud', combined with use of Cloudflare nameservers and a .icu TLD (known for abuse). However, the page itself is a generic hosting-provider placeholder in Chinese ('Congratulations, site creation successful'), not an impersonation attempt. The evidence suggests infrastructure consistent with typosquatting or preparation for abuse, but no active phishing content is currently deployed.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, September 4, 2026
Same data as JSON: /api/zone/domain/cdn-ws-cloud.icu. This page is not indexed by search engines and does not link to the site it describes.