A .cn phishing site: Tencent took it down in a day
On April 25, 2026 we reported a live phishing page to two channels on the same day and watched what happened. The page sat on a .cn domain under a randomized subdomain, typical of a single-use kit deployment.
| Channel | Submitted | First action | Site removed |
|---|---|---|---|
| Tencent abuse team | 2026-04-25 | acknowledgment within 1 working day | ~24 hours later |
| Google Safe Browsing | 2026-04-25 | (none observed) | 3+ days, never responded |
It's one case, not a statistic, but the reason behind it is structural.
What's actually happening
Google Safe Browsing is a browser warning system, not a takedown service. When a URL is submitted, Google decides whether to add it to the phishing blocklist used by Chrome, Safari and Firefox. The site keeps running on its origin host; only the visit warning goes out. For .cn-hosted infrastructure with no Western CDN in front, Google has no leverage on the origin at all: the most it can do is warn visitors, and in this case we saw no warning in three days.
Tencent's abuse team works differently. Tencent runs the registrar (DNSPod), the hosting (Tencent Cloud), the QQ Browser blocklist, WeChat security, and the phishing classifier inside its PC manager. When that team acts, the site can disappear from DNS, the host can pull the page, and Chinese browsers and chat clients add a warning, all in one chain. For infrastructure Tencent itself runs, its abuse team is the one party that can act on every layer at once, so in our one case it was the fastest route.
Most general advice treats a browser blocklist as the front-line action and the registrar as a secondary track. For Western-hosted phishing, that's roughly right. Where one company controls the domain, the host and the local browsers, the picture is different. We wouldn't generalize from a single case.
Update, September 2026
Two updates since this was written. The reporting service that routed our April report is no longer free. It now lists a single plan at $500 a month, so that route is open only to paying users. And the conclusion about Google held up in a way we didn't expect: in a clone-shop case in September 2026, the registrar was again the party that made the domains disappear, not a browser blocklist.
What to take from this
Which company can act depends on who runs each layer of the site, and those companies differ a lot in speed, in what they need to see, and in whether they answer at all. Success on one kind of infrastructure says little about the next. This is why we handle these reports for brands instead of leaving them to a checklist.
OpenBait's Free plan covers one brand, including the public report page. how a report becomes a takedown shows what happens after a site is reported. The brand-protection comparison says where we don't compete.
Related reading
Last updated: October 12, 2026
A fake site using your name?
Give customers one link to report it. We check each report in seconds and send phishing sites to the browser blocklists. Free for one brand. Paid plans also report them to the host and registrar once you confirm.
Get your free report pageRelated articles
Someone copied your website or store? What you can do
Who can take down which part of a copied website or store, and what happened when we reported five copies of one US retailer's store.
Five clones of one store: what each abuse team did
A US retailer's online store was cloned five times in September 2026. Here is what the registrar, the hosts and the blocklists each did, hour by hour.
The first 48 hours of a phishing incident: 7 steps
The first 48 hours after a phishing site goes live in your brand's name: who moves inside the company, what to protect, and which outside companies can act.