Security Scan Report: xcat2026.com

Site favicon
Submitted: Sep 13, 2026, 5:27:27 PMCompleted: Sep 13, 2026, 5:27:53 PMpubliccompleted

This website contacted 7 IPs in 4 countries across 6 domains to perform 25 HTTP transactions. The main domain is xcat2026.com and was registered 10 years ago.

Submitted URL: https://xcat2026.com/auth/login?callback=%2Fuser%2Fshop

AI Security Verdict

Confirmed Scam

Confidence: 93%

10
Risk Score

Four-day-old unranked domain impersonating Telegram and harvesting email, password and 2FA codes for Telegram accounts — a credential-phishing page. Do not enter any credentials.

Risk Factors (5)
Brand impersonation: displays 'Telegram 登录' / Telegram branding on the non-Telegram domain xcat2026.com
Credential-harvesting form: email + password + 2FA code fields targeting Telegram accounts
Domain registered 4 days ago (2026-09-09) — critical risk age
Domain unranked in Cisco Umbrella (not in top 1M)
Telegram auth cookie (stel_ssid) and Telegram OAuth/telegram.org lookups observed in network traffic, indicating session/credential handling
Domain age information unavailable

Details

Page Title

喵了个咪 · XCAT · 学习助理 | Secured Private Networks

Scan Type

public

Domain Name Analysis

The domain 'xcat2026.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. Count 8 characters in 'xcat2026' with one vowel and 3 consonants, notching 4 digits. Word splitting yields 3 words: xc, at, 2026. Median word length comes out to 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://xcat2026.com/auth/login?callback=%2Fuser%2Fshop

Page Load Overview

6.56s
Total Load Time
786 KB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

HTML Lang Attribute:zh-cn
Text Length:307 chars
Detector Agreement:67%

Website Classification

Primary Category

social media network74% confidence
Type: webapp
Method: ml+structural

All Detected Categories

social media network
74%
education learning
54%
technology software
35%
adult content
31%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7185.111.111.157Frankfurt am Main, Hesse, Germany
AS212238Datacamp Limited
3188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.17.5.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3185.111.111.155Frankfurt am Main, Hesse, Germany
AS212238Datacamp Limited
3149.154.167.99Amsterdam, North Holland, Netherlands
AS62041Telegram Messenger Inc
3104.17.6.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
343.159.109.100Singapore
257--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1933168A35565200D3A00F34CE9547078CD17450FDEABA950F9AE023DAFF2AB7849793D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:kup2EjzvCVzvTVzv4VJwM+JedK0CHJtXCZc:kuHzaVzrVzQVJwvJedKLHJFCZc

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1697:BAAIFAAIBgAAAAQQAAwAAABCgBgAABAAAQIAAAAAAABQAAAAAAAAkBCgAAIAAEIEAAACEEAAEQAAECgAAAAAAAxAIAAYAAAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0018181818181800
Perceptual Hash:89cc66db32333366
Difference Hash:32b2b2b2b2b2b28d
Wavelet Hash:183d3f3d3c3c3c18
Color Hash:#a1c587

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data