Highscore 42 · flagged Monday, November 9, 2026

xiaohavpn.app

Appeared in the .app zone on Monday, November 9, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Netflix
+22
brand in page title, not in the name
matched: netflix
+20
Registrar
Sav.com, LLC
Nameserver provider
Nameservers
arvind.ns.cloudflare.com, reza.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
小哈VPN|小哈VPN下载 - 一键秒连的稳定网络加速器
Has a form
no
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 62%· claude-opus-5-5

This is a Chinese-language landing page for its own product, 小哈VPN (Xiaoha VPN), with matching logo, pricing, FAQ and download sections, no form and no offsite links. Netflix, YouTube and ChatGPT appear only as use cases for the VPN, so the scorer's Netflix impersonation flag is a false positive. One caveat: the 'nodes under attack, see temporary recommended solution' banner resembles SEO-funnel pages that steer users to a substitute service, which keeps confidence moderate.

First passlooks like abuseconfidence 85%· claude-haiku-4-5

Xiaoha VPN is a legitimate VPN service with its own brand identity and login system; the SCORER's detection of 'Netflix' as impersonation is a false positive triggered by Netflix being mentioned as one of many services the VPN claims to unblock (common marketing language for VPN products). The page title, branding, and content are consistently in Chinese under the 'Xiaoha VPN' brand name with no attempt to impersonate Netflix or another organization. However, this is classified as abuse because

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, November 9, 2026

Screenshot of xiaohavpn.app taken by the zone census on 2026-11-09

Same data as JSON: /api/zone/domain/xiaohavpn.app. This page is not indexed by search engines and does not link to the site it describes.