tenzium[.]com

Analysis of the domain tenzium.com indicates active phishing infrastructure designed to harvest user credentials under the guise of cloud service authentication. Registered on May 9, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, the domain currently resolves to 51.89.3.223, an IP address hosted by OVH GmbH in the United Kingdom. The site returns an HTTP 200 status and displays a page titled 'Loading,' a common tactic to mask malicious intent while scripts or redirects prepare the final phishing interface. Infrastructure review reveals the domain uses Cloudflare nameservers (hassan.ns.cloudflare.com and tess.ns.cloudflare.com), a frequent choice among threat actors to obscure hosting origins and evade takedowns. The SSL certificate, issued by Let's Encrypt (R13), provides encryption but does not validate legitimacy, as phishing sites routinely deploy certificates to appear trustworthy. MX records point to mail.hotwall.app (priority 10), suggesting potential email-based attack vectors or spoofed communication channels linked to the campaign. Security telemetry shows tenzium.com is flagged by one of 95 vendors on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is included in a threat intelligence pulse on AlienVault OTX, corroborating its malicious classification. Defenders should treat this domain as high-risk, particularly for organizations using cloud services, and consider blocking resolution at the DNS or proxy level. Monitoring for related domains registered through the same registrar or resolving to the same IP may uncover additional components of this phishing operation.