When you land on msg-img.xhscdn.com.w.cdngslb.com, the first problem is that your browser won't connect securely at all. A functioning HTTPS certificate is the bare minimum for any website in 2025 — without it any information sent or received is exposed to interception. This site has no HTTPS, which means you cannot safely enter data or even browse it without risk.
The domain name itself looks like an auto-generated CDN hostname tied to the Taobao network in China. Most legitimate content delivery networks serve their owners' HTTPS-enabled domains, not standalone addresses that block inspection. There is no about page, no company name, no privacy policy, and no way to contact anyone behind it. For a site that serves content to users — even if that content is just images — the complete opacity is a warning, not a quirk.
The question 'is msg-img.xhscdn.com.w.cdngslb.com a scam' is a bit misplaced: the site may not be a deliberate fraud so much as an unmaintained or misconfigured endpoint. But the effect is the same — you have no way to verify its purpose or its safety. Until it gains a valid HTTPS certificate and basic identity information, treat it as untrusted and do not visit it from a browser where you enter passwords or payment details.