Chinese-language fake software download sites (Google Chrome, WPS Office, QuickQ, Sunlogin) behind a search-engine cloak

Chinese-language look-alike download sites for Google Chrome, WPS Office, the QuickQ VPN client and Sunlogin remote desktop, active since at least June 2026, on typosquat .cn and .com.cn domains such as chroromee-google[.]com[.]cn, wwps-wps-office[.]cn, quickqick[.]com[.]cn and anydesksk[.]com. Doorway sites such as chromee-google[.]com, chromeer-google[.]com[.]cn and pcchrome-google[.]com[.]cn carry a search-engine cloak: search-engine crawlers see the page, a visitor arriving from a search result is sent on to the fake download site, and anyone else is sent to a search engine, so a direct visit shows nothing of the lure. Every site is generated separately, but each lure family reuses the operator's own page template. Most download buttons were empty when seen; the fake Sunlogin site linked installer archives on third-party hosting. A match means a page carrying the operator's page templates or the cloak script, or a scan of a known campaign host or server address.