oc-google[.]com[.]cn

Analysis indicates oc-google.com.cn is a high-risk brand impersonation domain targeting Google through fraudulent Chrome download distribution. The infrastructure and content strongly align with fake software delivery pages designed to deceive users into installing malicious payloads or redirecting to unsafe installers. The threat type is classified as brand impersonation with a focus on browser download deception.

Technical intelligence confirms multiple malicious indicators. VirusTotal reports 10/95 security vendors flagging the domain as malicious. The domain was registered through 浙江贰贰网络有限公司 and was created on April 06 2026. It is currently active and has been blocked by PhishDestroy, and appears on 1 security blocklist. The SSL certificate is issued by Let's Encrypt / R12. The domain resolves to IP 156.240.32.52, geolocated in HK under Zillion Network Inc. The page title observed is encoded as “谷歌浏览器官方下载_Google Chrome最新免费下载-Windows版”, indicating direct impersonation of official Google Chrome download branding. These combined indicators demonstrate coordinated spoofing of legitimate software distribution channels.

Mitigation should focus on blocking the domain at DNS, proxy, and endpoint levels due to confirmed impersonation behavior and active malicious hosting. Network defenders should enforce domain-based filtering for oc-google.com.cn and monitor outbound requests to 156.240.32.52. Users should be prevented from downloading executables originating from this infrastructure, and any attempted access should trigger phishing warnings. Security teams should correlate the domain with known impersonation patterns, isolate any systems that interacted with it, and review browser download histories for potential compromise. Continuous monitoring is recommended due to its active status and existing presence on multiple threat detection systems.