Highscore 58 · flagged Thursday, October 8, 2026

xinweicloud.cfd

Appeared in the .cfd zone on Thursday, October 8, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: icloud
+30
TLD with a high abuse rate
matched: cfd
+8
brand name behind Cloudflare
matched: cloudflare.com
+6
brand name at a retail registrar
matched: Spaceship, Inc.
+8
brand name at a watch-list registrar
matched: Spaceship, Inc.
+6
Registrar
Spaceship, Inc.
Nameserver provider
Nameservers
jo.ns.cloudflare.com, quincy.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
星维机场 - 2026套餐价格、节点线路与使用选择指南
Has a form
no
Brand echoed
icloud

Model opinions

Second opinionlooks benignconfidence 70%· claude-opus-5-5

The 'icloud' hit is a false positive: the name splits as xinwei + cloud, the site's own brand (星维机场). The page is a Chinese proxy/VPN 'airport' plan-and-node guide with affiliate links (yuzhouaff.com, tizicloud.com), with no login form and no Apple branding, so it reads as an affiliate SEO landing page, not impersonation.

First passlooks like abuseconfidence 85%· claude-haiku-4-5

The domain xinweicloud.cfd uses 'icloud' (Apple's brand) in a typosquat name with .cfd TLD and is hosting a Chinese VPN/proxy service ('星维机场' - Xinwei Airport) with no legitimate connection to Apple. The page offers VPN packages and nodes, with links to affiliate VPN services (youyou.yuzhouaff.com, tizicloud.com), indicating a brand-squat used to redirect traffic for a VPN affiliate scheme rather than phishing credentials.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, October 8, 2026

Screenshot of xinweicloud.cfd taken by the zone census on 2026-10-08

Same data as JSON: /api/zone/domain/xinweicloud.cfd. This page is not indexed by search engines and does not link to the site it describes.