Criticalscore 68 · flagged Thursday, November 5, 2026

xn--mes358aby2apfg.top

Appeared in the .top zone on Thursday, November 5, 2026; by the end of that day the census found active website about education. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

punycode name
matched: 赔钱机场 scripts=CJK
+18
TLD with a high abuse rate
matched: top
+8
page impersonates a brand
matched: Netflix
+22
brand in page title, not in the name
matched: disney
+20
Registrar
—
Nameserver provider
Nameservers
jasmine.ns.cloudflare.com, leonard.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
赔钱机场官网 - 2026好用稳定高性价比梯子 | IEPL千兆专线·流媒体与AI极速解锁
Has a form
no
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 65%· claude-opus-5-5

This is a Chinese-language marketing page for its own proxy/VPN 'airport' brand (赔钱机场, 'Peiqian Airport'), with no login form. Netflix and Disney+ appear only as streaming services it claims to unlock, not as impersonation, and the CTAs go to an affiliate panel (vipmjj01.jlyvipaff.com), which points to an affiliate funnel rather than credential or payment capture under a borrowed brand.

First passlooks like abuseconfidence 92%· claude-haiku-4-5

This is a VPN/proxy service (赔钱机场 'Peiqian Airport') advertising circumvention of geo-restrictions for Netflix, Disney+, ChatGPT, and Claude. The mentions of Netflix and Disney in page text are feature descriptions of what the service unlocks, not impersonation of those brands. The domain is a punycode obfuscation (赔钱机场) combined with a .top TLD, typical of Chinese VPN/proxy abuse infrastructure. The service itself is the abuse—unlicensed traffic-shaping infrastructure marketed to bypass regiona

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, November 5, 2026

Screenshot of xn--mes358aby2apfg.top taken by the zone census on 2026-11-05

Same data as JSON: /api/zone/domain/xn--mes358aby2apfg.top. This page is not indexed by search engines and does not link to the site it describes.