https://accounts.evilash.ccwu.cc/pLiZIvOl
43.161.231.117 · Tencent Cloud Computing (Beijing) Co., Ltd
Hong Kong, Hong Kong
264 days
200 · 61.7s
Valid· E8, Let's Encrypt, US
COMPLETED
Domain Intelligence: ccwu.cc
Scanned 4 times since May 9, 2026, 01:35 AM UTC
Registered-domain escalation suggested
Suggested nowSubmit ccwu.cc as the primary IOC, enriched with evidence from hostile subdomains like accounts.evilash.ccwu.cc.
2 hostile subdomains across 2 completed scans were observed under this registered domain. Recent hosts: accounts.evilash.ccwu.cc, www.qq.com.
No KB/IOK detections were recorded for this scan.
technology | finance | ecommerce | social_media · 6/3/2026
The page presents Tencent branding (title 腾讯网) and loads numerous Tencent/QQ resources, but the domain used is accounts.evilash.ccwu.cc which does not belong to Tencent. The final URL redirects to www.qq.com, and the HTML content, scripts, and network activity reference Tencent QQ/inews.qq.com domains, suggesting an impersonation attempt attempting to lure victims to Tencent content. The SPA-like page uses numerous external assets and appears to render credential-like UI via JavaScript, with off-domain endpoints and POSTs to Tencent analytics/ad services observed, indicating potential credential harvesting or data exfiltration behavior despite the final redirection to a legitimate Tencent domain.
Capture
Stages: 2
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 176
Hosts: 31
Domains: 5
Suspicious Endpoints
hxxps://i[.]news[.]qq[.]com/api/ip2city
hxxps://tnfe[.]gtimg[.]com/tnt/api/upload/upload_f00cf80729321a253c695896a832a83b.jpg
Off-Domain Posts
hxxps://tnfe[.]gtimg[.]com/tnt/api/upload/upload_f00cf80729321a253c695896a832a83b.jpg
The scan indicates explicit impersonation of Tencent's Tencent/QQ brand on a non-official domain (accounts.evilash.ccwu.cc) with multiple off-domain API calls and POSTs to Tencent endpoints, suggesting potential credential harvesting or data exfiltration. The final redirect to www.qq.com may be intended to trap victims into believing they reached the legitimate site while initial requests and assets originate from a suspicious host. The presence of an active SPA rendering forms via JavaScript, numerous external scripts, and off-domain analytics calls elevates risk. Recommend treating this as a phishing/branding impersonation attempt with data exfiltration risk and consider takedown actions or suspension of the offending domain if corroborated by hosting/provider policies.
Monitor