A .cn phishing site: Tencent took it down in a day

On April 25, 2026 we reported a live phishing page to two channels on the same day and watched what happened. The page sat on a .cn domain under a randomized subdomain, typical of a single-use kit deployment.

It's one case, not a statistic, but the reason behind it is structural.

What's actually happening

Google Safe Browsing is a browser warning system, not a takedown service. When a URL is submitted, Google decides whether to add it to the phishing blocklist used by Chrome, Safari and Firefox. The site keeps running on its origin host; only the visit warning goes out. For .cn-hosted infrastructure with no Western CDN in front, Google has no leverage on the origin at all: the most it can do is warn visitors, and in this case we saw no warning in three days.

Tencent's abuse team works differently. Tencent runs the registrar (DNSPod), the hosting (Tencent Cloud), the QQ Browser blocklist, WeChat security, and the phishing classifier inside its PC manager. When that team acts, the site can disappear from DNS, the host can pull the page, and Chinese browsers and chat clients add a warning, all in one chain. For infrastructure Tencent itself runs, its abuse team is the one party that can act on every layer at once, so in our one case it was the fastest route.

Most general advice treats a browser blocklist as the front-line action and the registrar as a secondary track. For Western-hosted phishing, that's roughly right. Where one company controls the domain, the host and the local browsers, the picture is different. We wouldn't generalize from a single case.

Update, September 2026

Two updates since this was written. The reporting service that routed our April report is no longer free. It now lists a single plan at $500 a month, so that route is open only to paying users. And the conclusion about Google held up in a way we didn't expect: in a clone-shop case in September 2026, the registrar was again the party that made the domains disappear, not a browser blocklist.

What to take from this

Which company can act depends on who runs each layer of the site, and those companies differ a lot in speed, in what they need to see, and in whether they answer at all. Success on one kind of infrastructure says little about the next. This is why we handle these reports for brands instead of leaving them to a checklist.

---

OpenBait's Free plan covers one brand, including the public report page. how a report becomes a takedown shows what happens after a site is reported. The brand-protection comparison says where we don't compete.

---

Related reading

• Phishing takedown services: in-house, agency, or SaaS?
• The first 48 hours of a phishing incident: 7 steps