web-google1[.]com[.]cn

Analysis of the domain web-google1.com.cn shows a high‑risk, brand‑impersonation infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Web Commerce Communications Limited and resolves to the IP address 156.244.176.137, which is hosted in Hong Kong and announced by ASN 9294 GNET INC. No SSL certificate is presented for the site, indicating that communications are unencrypted. The web page returns the title "谷歌浏览器-快速安全的网络浏览器，专为您而打造," directly referencing Google and confirming the intent to masquerade as the Google browser product. The site is classified as a tech‑support scam, a common vector for credential theft and monetary extortion.

Detection evidence shows that 12 of 93 security vendors on VirusTotal flagged the domain as malicious, and the domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. These blocklists have already taken action to prevent resolution for end‑users. The nameservers a10.share-dns.com and b10.share-dns.net are typical of fast‑flux or shared DNS services, which can aid rapid redeployment of the infrastructure if the operator chooses to reactivate the site. Uncertainties remain regarding the specific payload or phishing pages that were served, as the site is currently offline and no additional content analysis is available.

No evidence of a valid TLS certificate, redirect chains, or additional sub‑domains was observed. Defenders should update perimeter filters to block the listed nameservers and the resolved IP address, add web-google1.com.cn to domain reputation and URL filtering lists, and monitor for any re‑registration attempts that reuse the same registrar or hosting ASN. Continuous telemetry from endpoint detection platforms should watch for the 12 vendor signatures that previously flagged the domain, as they may indicate related malicious binaries or scripts.