# PhishDestroy domain threat record: qiumenghui-yahoo.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/qiumenghui-yahoo.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/qiumenghui-yahoo.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-15 15:05:42 UTC
- Last availability or vendor check: 2026-10-22 10:42:19 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: yahoo

## Stored infrastructure

- Observed IP address: 160.124.216.180
- Registrar in stored WHOIS data: 广东时代互联科技有限公司
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-17 20:09:23 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a14017-2772-7513-88c7-7d8c360b557d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/qiumenghui-yahoo.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.qiumenghui-yahoo.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://qiumenghui-yahoo.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
qiumenghui-yahoo.com.cn is an impersonation phishing site that puts the Yahoo brand into its domain name to borrow trust it has no right to. It targets Chinese-speaking users, who are likely to see a familiar name in the address bar and assume the site is legitimate. PhishDestroy first saw the domain on 2026-10-15, and as of 2026-10-19 the site is still online and serving content.

How the scam works
Impersonation schemes pair a trusted brand with a lookalike domain so visitors drop their guard and type in logins, personal details or payment information. Whatever the victim enters goes to the operators, who can use it to take over accounts or commit fraud. The page title reads "球盟会·QMH(中国)-官方网站", which presents the site as the official website of a brand called Qiumenghui (QMH, China). That title does not match the Yahoo name in the domain, but we classify the site as Yahoo impersonation based on how the domain is built.

Evidence
On 2026-10-19, VirusTotal showed 6 of 92 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That detection rate is modest, so many security products will not block the site yet. The domain is listed on the PhishDestroy, MetaMask and SEAL blocklists, and it appears in 3 AlienVault OTX threat pulses.

Infrastructure
The domain was registered on 2026-09-17 through 广东时代互联科技有限公司, less than a month before PhishDestroy detected it. It resolves to 160.124.216.180 on POWERLINE-AS-AP (POWER LINE DATACENTER) in Hong Kong. HTTPS is provided by a Let's Encrypt certificate issued under YE2, so the padlock icon proves only that the connection is encrypted. It says nothing about whether the site is legitimate.

What to do
If you entered a Yahoo password or any other credentials here, change them right away on the real service, along with any account that uses the same password, and turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and dispute any unfamiliar charges. Watch for follow-up phishing emails or messages that use the information you gave the site. Defenders should block the domain and 160.124.216.180 at DNS, proxy and email gateways, and search their logs for any users who visited it. Report the site to Yahoo and to the registrar and hosting provider so it can be taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14017-2772-7513-88c7-7d8c360b557d/
VirusTotal report: https://www.virustotal.com/gui/domain/qiumenghui-yahoo.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=qiumenghui-yahoo.com.cn
Archived copy: https://web.archive.org/web/20261015150617/https://qiumenghui-yahoo.com.cn/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:22:54 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/67NP4RB0/9a7ab61ba816.png
  Captured: 2026-10-15 15:05:42 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a14017-2772-7513-88c7-7d8c360b557d.png
  Captured: 2026-10-15 15:05:42 UTC
  Source report: https://urlscan.io/result/01a14017-2772-7513-88c7-7d8c360b557d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ea506ee5-c894-41bc-bae7-b5e28ab17125.png
  Captured: 2026-10-15 15:36:22 UTC
  Source report: https://radar.cloudflare.com/scan/ea506ee5-c894-41bc-bae7-b5e28ab17125
  SHA-256: b88e5f61f0cd84125d4330af548e1a84382c757a5df63f96105be8b4a3c01444
- URLQuery: https://screenshots.phishdestroy.io/uq/7169346f-6d96-4944-b80c-1e29cc5885b6.png
  Source report: https://urlquery.net/report/7169346f-6d96-4944-b80c-1e29cc5885b6
  SHA-256: 139d73765d35da607d608ca9457a96a27f292340ae9b56279cf2badabc42189d
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a14010-e604-7287-bf21-d767d975595c.png
  Captured: 2026-10-15 14:57:06 UTC
  Source report: https://urlscan.io/result/01a14010-e604-7287-bf21-d767d975595c/
  SHA-256: 4ffda677f8d04510381165d4d9b35fd316174a4f55bcceb96a93a6cb3624bb0f
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a140ef-b2a2-74b0-aac0-db1260a97755.png
  Captured: 2026-10-15 19:00:25 UTC
  Source report: https://urlscan.io/result/01a140ef-b2a2-74b0-aac0-db1260a97755/
  SHA-256: 0041c3a1f7655ad6ffad097b477b25708569d276b601a42c08dcbf40044daa9e
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a143f9-2c95-779f-ad44-03017445bbe1.png
  Captured: 2026-10-16 09:09:44 UTC
  Source report: https://urlscan.io/result/01a143f9-2c95-779f-ad44-03017445bbe1/
  SHA-256: 656f6c21a66b39d0ce95acfc032e971cc4734bdb89317d497d36a75ddd2817df
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1450b-fea3-77e3-8bec-e60ca504e7a5.png
  Captured: 2026-10-16 14:09:47 UTC
  Source report: https://urlscan.io/result/01a1450b-fea3-77e3-8bec-e60ca504e7a5/
  SHA-256: c2f16f5d60081c5343479e3e928a126e2556685b63b64e6a0b5413db6a4f6387
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14888-3bf6-76d8-8b18-41e623f70bf9.png
  Captured: 2026-10-17 06:24:23 UTC
  Source report: https://urlscan.io/result/01a14888-3bf6-76d8-8b18-41e623f70bf9/
  SHA-256: 809603d216a6d8a2bd70d4684a21d890be50a3fc16ecfce32e870a31403dd4f6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:47:21Z",
        "uuid": "01a14017-2772-7513-88c7-7d8c360b557d",
        "scanned_at": "2026-10-15T15:03:50Z",
        "final_url": "https://qiumenghui-yahoo.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://qiumenghui-yahoo.com.cn/",
                "from": "http://qiumenghui-yahoo.com.cn/",
                "status": 307
            }
        ],
        "ip": "160.124.216.180",
        "domains": [
            "hm.baidu.com",
            "cdnjs.cloudflare.com",
            "rb9177.com",
            "rb3289.com",
            "ue6906.com",
            "ue1912.com",
            "lwhuzi.com",
            "lw1616.com",
            "th6241.com",
            "wj1903.com",
            "qmjiayu.com",
            "qm8051.com",
            "qy3507.com",
            "qycion.com",
            "jx1638.com",
            "jx3256.com"
        ],
        "ips": [
            "14.215.183.79",
            "104.17.25.14",
            "160.124.216.180"
        ],
        "asns": [
            "4134",
            "13335",
            "132839"
        ],
        "countries": [
            "CN",
            "ZA"
        ],
        "link_domains": [
            "qyh999.com",
            "qyh918.com",
            "jx3256.com",
            "qycion.com",
            "qm8051.com",
            "wj1903.com",
            "lw1616.com",
            "ue1912.com",
            "rb3289.com"
        ],
        "doc_hash": "9f0045536d22aad8029913ed14210e4be769f1fd4a98a7a87d057b3e67e177cc",
        "script_hashes": [
            "a4b8ea590116f1ccac249ca1bd4e4b3b078f24580d022f9e3a737afdd9d06c5b",
            "8d943e3ceaabae35ab80f895374a3bfaff7d35eb60343efe08f88e7ad74de29d",
            "900fb11afa49e0dabb267232438aad19b736d52bee903fab08008b582c755524",
            "8cc4e1ed293f6a11601fb6345e546410af306a0d30b9ad9dbd0a8ebbe8c9e051"
        ],
        "globals": [
            "_hmt",
            "_bdhm_loaded_bf8061ca73eaa705ec626f7edd51c901",
            "mini_tangram_log_qnyycr"
        ],
        "cookies": [
            "Hm_lvt_329a636047682dfecc9be43978082a1e",
            "Hm_lpvt_329a636047682dfecc9be43978082a1e",
            "HMACCOUNT",
            "HMACCOUNT_BFESS",
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901"
        ],
        "storage_keys": [
            "Hm_lpvt_329a636047682dfecc9be43978082a1e",
            "HMACCOUNT",
            "Hm_unsent_329a636047682dfecc9be43978082a1e",
            "Hm_lvt_329a636047682dfecc9be43978082a1e",
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_unsent_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901"
        ],
        "tls": {
            "san": [
                "m.qiumenghui-yahoo.com.cn",
                "qiumenghui-yahoo.com.cn",
                "www.qiumenghui-yahoo.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "qiumenghui-yahoo.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T06:22:02Z",
            "valid_from": "2026-10-15T06:22:03Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 53,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:59:59Z",
        "uuid": "ea506ee5-c894-41bc-bae7-b5e28ab17125",
        "scanned_at": "2026-10-15T15:36:22Z",
        "final_url": "https://qiumenghui-yahoo.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://qiumenghui-yahoo.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "a4c5a6740dd8212c07b157066aa6ea36e7e6d6cff2c99d62a7fa250468e7fc4a",
        "doc_hash": "e4b13992404e58f21032239b3081bce07ba41c895af197c35ba8c55b5c0af531",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "qiumenghui-yahoo.com.cn",
                "type": "A",
                "value": "160.124.216.180"
            }
        ],
        "dnssec_valid": false,
        "ip": "160.124.216.180",
        "whois": {
            "registrar": "广东时代互联科技有限公司",
            "created": "2026-09-17T22:09:23Z",
            "expires": "2027-09-17T22:09:23Z",
            "nameservers": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T21:11:16Z",
        "analysis_at": "2026-10-19T16:25:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-10-15T14:53:29Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.nowcndns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "160.124.216.180"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.nowcndns.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.nowcndns.com",
                "value": "ns1.nowcndns.com"
            }
        ],
        "dns_at": "2026-10-19T16:25:34Z",
        "jarm": "40d40d40d00040d00043d43d00043d3bef2bf79cd6719851e8198c1e8f9a14",
        "cert": {
            "san": [
                "m.qiumenghui-yahoo.com.cn",
                "qiumenghui-yahoo.com.cn",
                "www.qiumenghui-yahoo.com.cn"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5521537d65565d1da6433450b31a110803e",
            "sha256": "be9c7892f210737ed008ce152c4826cd0f13d45022df4f5a73863fd29ced5920",
            "subject": "qiumenghui-yahoo.com.cn",
            "valid_to": "2027-01-13T06:22:02Z",
            "valid_from": "2026-10-15T06:22:03Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.nowcndns.com",
                "ns2.nowcndns.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```