# PhishDestroy domain threat record: lewan-yahoo.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/lewan-yahoo.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/lewan-yahoo.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 13:51:08 UTC
- Last availability or vendor check: 2026-10-22 10:29:38 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 9/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 23.235.148.3
- Registrar in stored WHOIS data: 广东时代互联科技有限公司
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-17 13:04:42 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a12625-955e-72a3-9b01-c4e48d5d8b1d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/lewan-yahoo.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.lewan-yahoo.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://lewan-yahoo.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
lewan-yahoo.com.cn presents itself as "lewin乐玩-(中国)有限公司官方网站", the official website of a Lewin 乐玩 (China) company. Its audience is Chinese-speaking visitors who expect to reach that brand. PhishDestroy classifies it as an impersonation phishing page and first detected it on 2026-10-10. The site was still online and serving content when last checked on 2026-10-19. The domain also carries the Yahoo name, while the page itself shows only the Lewin 乐玩 branding.

How the scam works
Impersonation pages like this copy the name and look of a known brand so visitors believe they are on the genuine official site. The domain stacks two familiar names on a .com.cn address to look credible at a glance. Once a visitor trusts it, these sites typically ask for a login, personal details, or a payment or deposit that never reaches the real company. Victims lose the credentials, data or money they hand over.

Evidence
Nine of 92 VirusTotal engines flagged the domain as of 2026-10-16. The flagging vendors include Kaspersky, BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, CRDF, Gridinsoft and alphaMountain.ai. The domain also appears on the MetaMask and SEAL blocklists alongside PhishDestroy, so the classification does not rest on a single source. It is referenced in three AlienVault OTX threat pulses.

Infrastructure
The domain was registered on 2026-09-17 through 广东时代互联科技有限公司, just 23 days before PhishDestroy flagged it. That short gap fits a site set up for a campaign rather than an established business presence. It is hosted in Hong Kong on the POWERLINE-AS-AP (Power Line Datacenter) network. Its certificate comes from Let's Encrypt, so the padlock in the browser only means the connection is encrypted and says nothing about who runs the site.

What to do
Do not log in, submit details or send any payment through this site. If you entered a password here, change it on the genuine service and on any account that reuses it, then turn on two-factor authentication. If you paid or deposited money, contact your bank or payment provider immediately and report the transaction as fraud. Reach Lewin 乐玩 only through channels you have verified independently. Defenders should block the domain and its Hong Kong hosting IP at the DNS and proxy level, and search their logs for users who visited it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12625-955e-72a3-9b01-c4e48d5d8b1d/
VirusTotal report: https://www.virustotal.com/gui/domain/lewan-yahoo.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=lewan-yahoo.com.cn
Archived copy: https://web.archive.org/web/20261010135303/https://lewan-yahoo.com.cn/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 11:19:25 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a12625-955e-72a3-9b01-c4e48d5d8b1d.png
  Captured: 2026-10-10 14:11:23 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a12625-955e-72a3-9b01-c4e48d5d8b1d.png
  Captured: 2026-10-10 14:11:23 UTC
  Source report: https://urlscan.io/result/01a12625-955e-72a3-9b01-c4e48d5d8b1d/
- URLScan capture 2: https://urlscan.io/screenshots/01a1250e-98bb-708c-9dc2-676612cd3b85.png
  Captured: 2026-10-10 13:51:08 UTC
  Source report: https://urlscan.io/result/01a12625-955e-72a3-9b01-c4e48d5d8b1d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/722843bc-5be7-4120-a4d1-ac8a2feb59cd.png
  Captured: 2026-10-10 13:52:30 UTC
  Source report: https://radar.cloudflare.com/scan/722843bc-5be7-4120-a4d1-ac8a2feb59cd
  SHA-256: ce32067153d8b07fb51207ec7cc4b7d022e2a57a6af5a281856e8c2696948e0f
- URLQuery: https://screenshots.phishdestroy.io/uq/57ff9435-f2f8-4426-b679-5d9d3966a205.png
  Source report: https://urlquery.net/report/57ff9435-f2f8-4426-b679-5d9d3966a205
  SHA-256: 139d73765d35da607d608ca9457a96a27f292340ae9b56279cf2badabc42189d
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1250e-98bb-708c-9dc2-676612cd3b85.png
  Captured: 2026-10-10 09:04:44 UTC
  Source report: https://urlscan.io/result/01a1250e-98bb-708c-9dc2-676612cd3b85/
  SHA-256: c5ca8d152ce4ec34e97bb951255ed2b60e87a6df323bf41990eb8f4d81b1a877
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12618-6fdd-70c9-af1e-04f327c0b691.png
  Captured: 2026-10-10 13:55:06 UTC
  Source report: https://urlscan.io/result/01a12618-6fdd-70c9-af1e-04f327c0b691/
  SHA-256: 30a3ee44de3fee96f22522247b52ffb197716c616b7c9767f7b8c917fc1b3e5f
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12619-372a-722a-939d-a76fd41136fc.png
  Captured: 2026-10-10 13:55:56 UTC
  Source report: https://urlscan.io/result/01a12619-372a-722a-939d-a76fd41136fc/
  SHA-256: 60e7b1692dfb00c8fe786043d2943ab218b932a0631c11be6881529428381486

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:35:09Z",
        "uuid": "01a12625-955e-72a3-9b01-c4e48d5d8b1d",
        "scanned_at": "2026-10-10T14:09:28Z",
        "final_url": "https://lewan-yahoo.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://lewan-yahoo.com.cn/",
                "from": "http://lewan-yahoo.com.cn/",
                "status": 307
            }
        ],
        "ip": "23.235.148.3",
        "domains": [
            "hm.baidu.com",
            "cdnjs.cloudflare.com",
            "rb9177.com",
            "rb3289.com",
            "ue6906.com",
            "ue1912.com",
            "lwhuzi.com",
            "lw1616.com",
            "th6241.com",
            "wj1903.com",
            "qmjiayu.com",
            "qm8051.com",
            "qy3507.com",
            "qycion.com",
            "jx1638.com",
            "jx3256.com"
        ],
        "ips": [
            "14.215.182.140",
            "104.17.24.14",
            "23.235.148.3"
        ],
        "asns": [
            "4134",
            "13335",
            "132839"
        ],
        "countries": [
            "CN",
            "US"
        ],
        "link_domains": [
            "qyh999.com",
            "qyh918.com",
            "jx3256.com",
            "qycion.com",
            "qm8051.com",
            "wj1903.com",
            "lw1616.com",
            "ue1912.com",
            "rb3289.com"
        ],
        "doc_hash": "1de5e3c8949d8dd26bf236d353ff73bba9ff3202e5b2b9c726025e459a93d1ca",
        "script_hashes": [
            "7c2ac404e19102259140098e20e2dee659b9640e01aa3507fca6fc9d680345e8",
            "4b66c15a3061afa5100e572fd20db0795200e562d353e32632efbf42a60962fd",
            "900fb11afa49e0dabb267232438aad19b736d52bee903fab08008b582c755524",
            "8cc4e1ed293f6a11601fb6345e546410af306a0d30b9ad9dbd0a8ebbe8c9e051"
        ],
        "globals": [
            "_hmt",
            "_bdhm_loaded_bf8061ca73eaa705ec626f7edd51c901",
            "mini_tangram_log_hgqkur"
        ],
        "cookies": [
            "HMACCOUNT_BFESS",
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
            "HMACCOUNT",
            "Hm_lvt_329a636047682dfecc9be43978082a1e",
            "Hm_lpvt_329a636047682dfecc9be43978082a1e"
        ],
        "storage_keys": [
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
            "HMACCOUNT",
            "Hm_unsent_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lpvt_329a636047682dfecc9be43978082a1e",
            "Hm_unsent_329a636047682dfecc9be43978082a1e",
            "Hm_lvt_329a636047682dfecc9be43978082a1e"
        ],
        "tls": {
            "san": [
                "lewan-yahoo.com.cn",
                "m.lewan-yahoo.com.cn",
                "www.lewan-yahoo.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "lewan-yahoo.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-07T04:02:42Z",
            "valid_from": "2026-10-09T04:02:43Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:47Z",
        "uuid": "722843bc-5be7-4120-a4d1-ac8a2feb59cd",
        "scanned_at": "2026-10-10T13:52:30Z",
        "final_url": "https://lewan-yahoo.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://lewan-yahoo.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "2503a9f4a34cacd5757524325d8598c524dea57c28f1bc98e75ee0d1ee0846c4",
        "doc_hash": "55d2b75447d007b8be499df49dd06238d0b9c53e1dcc7975f5566ab044f0a2e4",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "lewan-yahoo.com.cn",
                "type": "A",
                "value": "23.235.148.3"
            }
        ],
        "dnssec_valid": false,
        "ip": "23.235.148.3",
        "whois": {
            "registrar": "广东时代互联科技有限公司",
            "created": "2026-09-17T15:04:42Z",
            "expires": "2027-09-17T15:04:42Z",
            "nameservers": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:03:40Z",
        "analysis_at": "2026-10-17T01:52:53Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 5,
            "suspicious": 4,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "suspicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "first_seen": "2026-10-09T20:11:49Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.nowcndns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.nowcndns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "23.235.148.3"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.nowcndns.com",
                "value": "ns1.nowcndns.com"
            }
        ],
        "dns_at": "2026-10-17T01:53:23Z",
        "jarm": "40d40d40d00040d00043d43d00043d3bef2bf79cd6719851e8198c1e8f9a14",
        "cert": {
            "san": [
                "lewan-yahoo.com.cn",
                "m.lewan-yahoo.com.cn",
                "www.lewan-yahoo.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "671333b3bbecba9bf4281989ec40f19c1c8",
            "sha256": "8e5d5554c62bbb35b536ee38c0e2467207a0ec8317ec592d648f62e4d540a47e",
            "subject": "lewan-yahoo.com.cn",
            "valid_to": "2027-01-07T04:02:42Z",
            "valid_from": "2026-10-09T04:02:43Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.nowcndns.com",
                "ns2.nowcndns.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```