oc-google[.]com[.]cn

PhishDestroy first observed oc-google.com.cn on May 22, 2026. The hostname explicitly references Google; stored content metadata identifies the same apparent target. The captured page title is “谷歌浏览器官方下载_Google Chromeæœ€æ–°å è´¹ä¸‹è½½-Windows版”. Stored page analysis classifies the content as brand impersonation. Current evidence score: 95/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, DNS security resolvers, Cloudflare Radar, and URLQuery. VirusTotal recorded 18 detections among 91 engines: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, Chong Lua Dao, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, SOCRadar, Sophos, VIPRE, Webroot on Aug 1, 2026 at 02:45 UTC. DNS security checks returned 8 blocking results across 14 tested policies: Adguard Family, Brand Google, Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware, Quad9 Secure; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. On May 22, 2026 at 07:25 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:05 UTC.

HTTP 502 server error was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the domain list 浙江贰贰网络有限公司 as the registrar and Apr 6, 2026 as the creation date. At collection time, the hostname resolved to 156.240.32.52 on AS139646 (HONG KONG LIGHTLAYER TECHNOLOGY CO., LIMITED). The recorded endpoint location is Hong Kong, HK. The stored server header is nginx. DOM analysis on Aug 1, 2026 at 02:20 UTC returned 73/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Aug 19, 2026; checked May 22, 2026 at 11:00 UTC.

The content indicators and 4 positive source findings support the current Google-themed brand impersonation classification.