Criticalscore 60 · flagged Saturday, October 31, 2026

hostmf.cloud

Appeared in the .cloud zone on Saturday, October 31, 2026; by the end of that day the census found active website about hosting & domains. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: PayPal
+22
brand in page title, not in the name
matched: paypal
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
ed.ns.cloudflare.com, nina.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
Cheap VPS & Web Hosting: Windows and Linux | HostMF
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 85%· claude-opus-5-5

The page is a full hosting storefront for HostMF (VPS and reseller plans, help center, server status, app links). Its links and the search form all point to the brand's own hostmf.com.br domain, so this looks like the company's own .cloud registration. The PayPal hit most likely comes from a payment-method mention: no PayPal branding or credential form appears in the title, text or screenshot.

First passlooks benignconfidence 85%· claude-haiku-4-5

The page is a legitimate hosting provider (HostMF) with its own brand, logo, and service offerings (VPS, web hosting). The 'brand-impersonation' scorer alert is a false positive: the page does not impersonate PayPal; it merely mentions 'credit card' as a payment method. The form posts to hostmf.com.br (the operator's own domain), links point to HostMF's own properties and social media, and the WhatsApp contact is standard for a Brazilian hosting business, not a phishing operator waiting room.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Saturday, October 31, 2026

Screenshot of hostmf.cloud taken by the zone census on 2026-10-31

Same data as JSON: /api/zone/domain/hostmf.cloud. This page is not indexed by search engines and does not link to the site it describes.