coffee-cloud.cyou
Appeared in the .cyou zone on Saturday, October 31, 2026; by the end of that day the census found active website about food & restaurants. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page is a Chinese proxy/VPN 'airport' (机场) subscription landing page with a coffee theme. It advertises IEPL/IPLC lines, residential IPs and streaming unlock, and has no form; 11 of its 20 links go to an affiliate host (tiziy01.ladderaff.com). Nothing impersonates Apple or iCloud, so the 'cloud≈icloud' typo hit is a false positive on a generic word, and this is a self-branded affiliate business rather than a phish.
This is a VPN/proxy service ('Coffee Cloud Airport') using airport/flight metaphor branding with no phishing form, but the domain contains a near-homophone typo (cloud≈icloud), is registered via a watch-list registrar (Spaceship), uses Cloudflare nameservers, and links to external affiliate/ad network (tiziy01.ladderaff.com×11). The pattern—brand-like name, typo proximity to Apple, affiliate monetization, and suspicious registrant profile—indicates a brand-squat proxy service, not phishing but a
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Saturday, October 31, 2026
Same data as JSON: /api/zone/domain/coffee-cloud.cyou. This page is not indexed by search engines and does not link to the site it describes.