A device showing the vendor Shenzhen Tencent Computer System — or a name like tencent32296 — means its network hardware or software is registered to Tencent, the Chinese company behind WeChat, QQ, and many mobile games. In practice it is almost always a phone, tablet, or smart-home gadget that you or someone in your household owns, running a Tencent app or using a Tencent-made network component. It is not, by itself, a sign of a hack. Below is how to confirm exactly which device it is — and what to do if you cannot account for it.
Every MAC address begins with a block that the IEEE assigns to the organisation that registered it — the OUI, or Organizationally Unique Identifier. Shenzhen Tencent Computer System Co., Ltd. holds three of these blocks, together covering roughly 34.6 million possible addresses, so any MAC that starts with one of Tencent's prefixes was handed out from that pool.
The important nuance: the MAC vendor tells you who registered the network block — not always the brand on the box. A network chip or module made for Tencent, or Tencent software that sets the device's name, can sit inside a product sold under a completely different name. Contract manufacturers and chip suppliers routinely appear in MAC lookups this way, which is why the registered vendor and the retail brand do not always match.
One detail you may see elsewhere but will not see asserted here: a specific registration year. The IEEE's public OUI data lists only the registry, the assignment, and the organisation's name and address — no registration date. The "date registered" values some lookup sites show (2013, 2015, 2018 and so on) are artifacts of those third-party databases, not facts published by the IEEE, so we do not repeat them as though they were.
Because Tencent is first and foremost a software and internet company, a "Tencent" device on your network is most often one of three things:
The hostname you are seeing — something like tencent32296 or tencent-1a2b3c — is generated automatically by that software or firmware. The trailing number or hex string is just an identifier that keeps device names unique on the network; it is not a serial number you need to decode, and it is not a sign of anything malicious. A recognisable vendor name like this is far more typical of an ordinary consumer device than of an intruder.
This is the part that answers "which of my things is it?"
192.168.1.1, 192.168.0.1, or 10.0.0.1 — and find the list called Attached Devices, DHCP Clients, or Device List.arp -a (or nmap) from a computer for more detail — or simply turn off or unplug your devices one at a time and refresh the router list to see which one disappears. That last trick is the most reliable way to pin down a stubborn entry.In most cases, no. If your Wi-Fi has a password, uses WPA2 or WPA3 encryption, and has WPS turned off, it is very unlikely that a stranger is on your network — the device is almost certainly one you or a guest brought in.
Two honest caveats are worth knowing:
If you have worked through the steps above and still cannot account for the device, here is how to remove it and tighten things up:
Usually not. It's typically a phone or smart-home device running Tencent software. Identify which of your devices it is before assuming anything is wrong.
That's an auto-generated hostname set by Tencent software or firmware on the device. The number is just an identifier, not a warning sign.
Shenzhen Tencent Computer System holds three IEEE-registered blocks: 1C:78:39 and 20:90:6F (both MA-L) and 30:09:F9 (MA-M). A device whose MAC address starts with one of these was assigned from a Tencent-registered block — though, as above, the vendor block identifies who registered the address, not always the device's retail brand.
Check your router's device list for the matching MAC, then match it to your gear — or turn devices off one at a time until it disappears from the list.
Yes. The most reliable way is to change your Wi-Fi password so every device must reconnect; you can also block the MAC in your router, keeping in mind MAC filtering is a weak control by itself.
No. The MAC vendor only identifies the company that registered the network block — it says nothing about malware.