Highscore 46 · flagged Saturday, October 24, 2026

zhaocaidanbaohoutaijiqiren.xyz

Appeared in the .xyz zone on Saturday, October 24, 2026; by the end of that day the census found parked, for sale. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: xyz
+8
brand in page title, not in the name
matched: telegram
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Dynadot Inc
Nameserver provider
Nameservers
ns1.dyna-ns.net, ns2.dyna-ns.net
First-day state
parked, for sale
HTTP status
200
Page title
招财担保机器人 · 管理后台
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 60%· claude-opus-5-5

The name decodes to 招财担保后台机器人 ('Zhaocai guarantee backend bot') and matches the page: a self-branded admin login for a Telegram group bot (roster, bookkeeping, admin authorisation). It says its credentials are 'managed separately from Telegram accounts' and uses no Telegram logo or account language, so the Telegram mention is integration, not impersonation. Telegram 'guarantee' (担保) groups are often tied to grey markets, but this page does not attempt to deceive visitors.

First passlooks like phishingtarget: Telegramconfidence 92%· claude-haiku-4-5

The page presents itself as a Telegram bot admin panel (招财担保机器人 · 管理后台) with explicit references to 'Telegram 管理后台' and 'Telegram 账号', displaying a login form (后台账号/登录密码) that posts to itself with no offsite links—the sealed-room credential-capture pattern. The page impersonates Telegram's infrastructure to harvest administrator credentials under the guise of a 'Zhaocai Baohuo' (招财担保) bot management interface.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Saturday, October 24, 2026

Screenshot of zhaocaidanbaohoutaijiqiren.xyz taken by the zone census on 2026-10-24

Same data as JSON: /api/zone/domain/zhaocaidanbaohoutaijiqiren.xyz. This page is not indexed by search engines and does not link to the site it describes.