Is xn--2-wxfs4ab4gvepc.com safe?

domain spoof risk

domain has spoofing indicators (punycode/confusable/highly synthetic naming)

encoded payload

suspicious base64-like blobs detected in page content

malicious redirect

script/meta redirect patterns detected in page source

malicious redirect

The scanned URL is xn--2-wxfs4ab4gvepc.com but all canonical, OG, and internal links consistently redirect to a different domain xn--3-wxfs4ab4gvepc.com. The HTML loads assets, sets canonical URL, and routes all navigation to the sister domain, silently redirecting any visitor or agent that follows links. This domain-hopping pattern between two IDN lookalike domains is characteristic of redirect chains used to launder traffic or evade blocklists. (location: page.html:16 (canonical), page.html:3 (asset link), page.html:350 (form action), page.html:375 (nav links))

hidden content

All thumbnail images use a 1x1 pixel inline SVG placeholder as the visible src attribute (data:image/svg+xml,%3Csvg...) with the real image deferred to data-src for lazy loading. While lazy loading is common, the combination with IDN obfuscation and cross-domain redirects means the true content is hidden until JavaScript executes, allowing the initial static snapshot to differ substantially from what a browser renders. This technique can evade static scanners. (location: page.html:370, page.html:596, page.html:680 (and throughout all content items))

social engineering

The site advertises 'คลิปหลุด' (leaked/non-consensual intimate imagery) including content explicitly described as secretly recorded ('แอบถ่าย' = voyeur/covert recording) and content described as involving non-consensual scenarios. Distributing such material is a form of social engineering / exploitation targeting visitors and the individuals depicted, and may be used as bait to drive clicks to third-party monetization or malware-serving ad networks. (location: page.html:380 (menu item แอบถ่าย), page-text.txt:42, page-text.txt:541)

malicious redirect

Banner ad link points to https://m.appcatcat.com/th/login — an external login page embedded as an ad on an adult content site. Presenting a login form via a banner ad on a third-party adult site is a classic credential-harvesting / phishing vector. Users (or agents) clicking the banner are taken directly to a login page on a domain unrelated to the site. (location: page.html:547-549)

phishing

A second banner ad links to https://xn---88-3ml6bqp5a9iqh.net/user/register — an IDN-encoded external domain registration page. Embedding a registration/signup link inside a banner on an adult content site, using an IDN domain that obscures the real destination, is a phishing tactic to harvest new account credentials under a deceptive pretext. (location: page.html:550-552)

brand impersonation

The site uses Punycode/IDN domain xn--2-wxfs4ab4gvepc.com which decodes to a Thai Unicode domain (เย็ดยับ2.com) visually mimicking its sister domain xn--3-wxfs4ab4gvepc.com (เย็ดยับ.com). The use of two near-identical IDN domains — differing only in a numeric suffix that is encoded in the Punycode — is a lookalike/typosquat technique used to impersonate the main site and capture misdirected traffic. (location: metadata.json:domain, page.html:3,7,16,103)

hidden content

The mobile off-canvas navigation menu contains a link to a third external domain xn--4-zwf1dh0cwczd6f.com ('หีคนไทย') that does not appear in the main desktop navigation. This domain is only exposed in the collapsed mobile menu, making it less visible to desktop users and scanners, and could point to a site with different risk characteristics. (location: page.html:520)

malicious redirect

Navigation menu contains multiple outbound links to entirely separate external domains including doujinfast.com, xn--3-7wf0bya3bzfvepc.com, xn--c3cy6ab7bk2dyg.net, and mlivehub2.com. These are third-party adult content sites embedded as first-party navigation items, creating an opaque redirect network where users are funneled to external domains without clear disclosure. (location: page.html:381-385)

hidden content

Footer/SEO text block contains keyword-stuffed descriptions referencing 'เย็ดยับ2.com' (the site's alternate domain) and lists of brand names (Blacked, Brazzers, Vixen, Tushy, Mofos, Reality Kings, FakeHub, Fake Taxi, etc.) as SEO bait. This hidden-from-primary-view promotional text attempts to associate the site with well-known brand names to manipulate search engine indexing and misdirect users searching for those brands. (location: page-text.txt:1313-1325)