wechatcorp[.]xyz

Analysis of the domain wechatcorp.xyz indicates a confirmed phishing operation targeting Google's brand identity, despite the domain name suggesting an affiliation with WeChat. The site was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 43.159.94.110, hosted on Cloudflare's network (AS13335) in the United States, with nameservers justin.ns.cloudflare.com and margot.ns.cloudflare.com. The use of Cloudflare and HTTP/3 suggests an attempt to obscure the origin server and enhance delivery speed, tactics commonly observed in phishing campaigns. The page title, 'WeChat - 全球10億用戶選擇的聊天通話應用程式,' explicitly references WeChat, a messaging platform, which creates a discrepancy with the stated brand target of Google.

This inconsistency may indicate an effort to exploit multiple brands or a misdirection tactic. As of the report date, the domain has been flagged by four of the 95 security vendors on VirusTotal, a detection rate that, while modest, aligns with the early stages of a phishing campaign before broader vendor coverage is achieved. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its malicious classification. Gridinsoft's trust score of 0/100 provides additional confirmation of the domain's high-risk status. The SSL certificate, issued by Google Trust Services (WE1), may have been leveraged to lend an appearance of legitimacy, though such certificates are routinely obtained by threat actors to bypass basic security checks.

The domain is currently offline, which could indicate takedown action or a temporary suspension by the threat actor to evade detection. Defenders are advised to treat this domain as a confirmed phishing threat. Network-level blocking of the IP 43.159.94.