OpenBait Team

OpenBait is run by a small team at Puson Limited (Hong Kong). We build and operate the report page ourselves, and we file the reports ourselves. Articles under this byline come from that work, not from a survey of other people's.

We don't publish individual names or credentials here. We publish what we did, with dates, so you can check it.

Reports we have filed

• April 25, 2026 — a phishing page on a .cn domain. Reported the same day to Google Safe Browsing and, through Phish.Report, to Tencent's abuse channel. The site went offline about a day later, through the Tencent route. We saw no warning from Safe Browsing in three days. Write-up.
• September 16–17, 2026 — five clone shops impersonating a US retailer, and the four domains collecting the card numbers. We first judged the shops offline when they had only stopped answering our vantage point, and we told the brand so. Third-party scans from other countries showed them still serving. We re-sent the reports with proof the sites were live, and within the hour two more domains moved to the registrar's suspension page. No registrar confirmed why, so we do not claim the cause. The whole case, hour by hour, including the wrong notice and the written correction we sent on September 20, is in a store cloned five times. What it taught us about reporting is in how to report a phishing domain to its registrar.
• July 25, 2026 — an audit of our own detection pipeline. Of 100 randomly drawn "high-risk" lookalike candidates, none was a live impersonation and 87 no longer existed. Here are the numbers, and why the product now starts from customer reports instead.

How we report

Reports go out from one fixed reporter address, contact@openbait.com, marked as made on behalf of the brand. We archive evidence with a third party while the site is still live. We send nothing to a hosting provider or a registrar until the brand confirms. There is more on the security page and in how a report becomes a takedown.

Corrections

We keep this list because a security vendor that never corrects anything isn't checking.

• September 23, 2026. Two posts said that in the September clone-shop case the brand had no valid US trademark registration. The registration our reports cited had been cancelled in 2025, but the brand had registered the same mark again in December 2025, which we found on September 22. The case study and the registrar guide now say so, and no longer present that case as evidence of what happens without a registration.
• September 20, 2026. A review of the whole site against the code, the production host and our case records. The security page was rewritten to describe only controls that exist. The Phish.Report comparison described that product as free and without detection. It is neither, and the page now says so. On the blog, we made these changes:
  • We removed similarity scores (pHash/SSIM) as recommended evidence. In our own case, the evidence that mattered was a third-party archive of the live page.
  • We corrected a statement that warning customers about a fake site is a legal duty. Breach-notification law concerns your own data.
  • We removed turnaround times we could not source.
  • We took out phrases implying more customers or years than we have.
  • We removed three posts that carried no first-hand information and folded two into others.