tencentcorp[.]xyz

Analysis of tencentcorp.xyz indicates a confirmed phishing domain targeting Outlook users through brand impersonation. The domain, registered on February 21, 2026, via NiceNIC International Group Co., Limited, is currently offline but was previously hosted on Cloudflare infrastructure (AS13335) with nameservers justin.ns.cloudflare.com and margot.ns.cloudflare.com. It resolved to IP 129.226.103.131, located in the US, though no SSL certificate was detected. The page title, '腾讯会议官方——腾讯会议 会开会,' suggests an attempt to mimic Tencent Meeting services, yet the domain is explicitly flagged for impersonating Outlook, aligning with its classification as a brand impersonation scam.

Detection data shows the domain is listed on three security blocklists and was flagged by 4 of 93 security vendors on VirusTotal, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. Defenders should treat this domain as a high-confidence phishing indicator, particularly for campaigns targeting Outlook credentials or related services.

While the site is offline, historical DNS records and blocklist entries should be incorporated into threat intelligence feeds to prevent future access or resurgence. No evidence of a phishing kit or specific payload is available, but the combination of Cloudflare hosting, lack of SSL, and brand impersonation tactics aligns with common phishing infrastructure patterns. Further investigation into the registrar and hosting provider may reveal additional linked domains or infrastructure.