# PhishDestroy domain threat record: qmh-google.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/qmh-google.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/qmh-google.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-19 01:39:07 UTC
- Last availability or vendor check: 2026-10-22 10:30:50 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google

## Stored infrastructure

- Observed IP address: 160.124.216.190
- Registrar in stored WHOIS data: 广东时代互联科技有限公司
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-17 20:10:08 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a151ce-b3d7-73c5-ab72-a61ee8a8b95f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/qmh-google.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.qmh-google.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://qmh-google.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
qmh-google.com.cn is a domain that mimics Google services, likely targeting users searching for Google tools, support, or downloads. PhishDestroy first identified the site on 2026-10-19. As of the last check, the site is marked as alive but unreachable, suggesting it may be intermittently active or actively blocked by hosting providers. The domain was registered on 2026-09-17, making it a recently created resource with a short operational history.

How the scam works
The domain uses Google’s branding to lure users into a false sense of security, potentially tricking them into entering credentials, downloading malicious files, or connecting wallets under the guise of legitimate Google services. While the exact mechanism is not confirmed by the evidence, the risk includes credential theft, malware installation, or financial loss through fraudulent transactions. The page title and content are not provided, so the specific lure cannot be detailed.

Evidence
VirusTotal scanned the domain on 2026-10-19 and found no detections out of 92 security engines, indicating that mainstream antivirus tools have not yet flagged it. Despite this, it is included in PhishDestroy, MetaMask, and SEAL blocklists, reflecting independent assessments of suspicious or malicious activity. OTX pulses also flag the domain, further supporting its classification as a potential threat.

Infrastructure
The domain was registered on 2026-09-17 through 广东时代互联科技有限公司. It is hosted on IP address 160.124.216.190, which is part of the network associated with this hosting provider.

What to do
If you visited qmh-google.com.cn or entered any information, immediately change passwords for any accounts tied to the use of Google services and scan your device for malware. Avoid downloading files or connecting wallets from untrusted domains. For defenders, block the domain at the network level and monitor for related activity. Report any suspicious interactions to PhishDestroy or relevant security teams.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a151ce-b3d7-73c5-ab72-a61ee8a8b95f/
VirusTotal report: https://www.virustotal.com/gui/domain/qmh-google.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=qmh-google.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 02:14:11 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/rCR8bz9/21bb705a20df.png
  Captured: 2026-10-19 01:39:07 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a151ce-b3d7-73c5-ab72-a61ee8a8b95f.png
  Captured: 2026-10-19 01:39:07 UTC
  Source report: https://urlscan.io/result/01a151ce-b3d7-73c5-ab72-a61ee8a8b95f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6c8b6048-1732-4299-9b5a-becbf49dad64.png
  Captured: 2026-10-19 02:12:23 UTC
  Source report: https://radar.cloudflare.com/scan/6c8b6048-1732-4299-9b5a-becbf49dad64
  SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924
- URLQuery: https://screenshots.phishdestroy.io/uq/244a5abf-0e33-4416-890f-9615d4e89098.png
  Source report: https://urlquery.net/report/244a5abf-0e33-4416-890f-9615d4e89098
  SHA-256: 139d73765d35da607d608ca9457a96a27f292340ae9b56279cf2badabc42189d
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151df-8f8f-76fd-8c70-b22928d85aac.png
  Captured: 2026-10-19 01:56:18 UTC
  Source report: https://urlscan.io/result/01a151df-8f8f-76fd-8c70-b22928d85aac/
  SHA-256: 6e4b9b42fc8d4d8370e14a73cdfb2e88c120d86740017c9087d906f27ca5a7e4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:44:34Z",
        "uuid": "01a151ce-b3d7-73c5-ab72-a61ee8a8b95f",
        "scanned_at": "2026-10-19T01:37:55Z",
        "final_url": "https://qmh-google.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://qmh-google.com.cn/",
                "from": "http://qmh-google.com.cn/",
                "status": 307
            }
        ],
        "ip": "160.124.216.190",
        "domains": [
            "rb9177.com",
            "rb3289.com",
            "ue6906.com",
            "ue1912.com",
            "lwhuzi.com",
            "lw1616.com",
            "th6241.com",
            "wj1903.com",
            "qmjiayu.com",
            "qm8051.com",
            "qy3507.com",
            "qycion.com",
            "jx1638.com",
            "jx3256.com",
            "hm.baidu.com"
        ],
        "ips": [
            "160.124.216.190"
        ],
        "asns": [
            "132839"
        ],
        "countries": [
            "ZA"
        ],
        "link_domains": [
            "qyh999.com",
            "qyh918.com",
            "jx3256.com",
            "qycion.com",
            "qm8051.com",
            "wj1903.com",
            "lw1616.com",
            "ue1912.com",
            "rb3289.com"
        ],
        "doc_hash": "a71dbc5cf153e20d0c20549c950ab470452315c33afb9b4e03d94a2420ac10a6",
        "script_hashes": [
            "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
            "a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d",
            "f9ce6ba1ac81597d0772a6d350b40209873bb5f16364bf86cb4925ed71c28649",
            "8b0f46ab652325be967956d4793f750cfa76a0a1e0d016222bda1005b1148766",
            "b9c90c601bc81ad71ed8be557ff9b095de5aae947926e84011e2728cf65250a6",
            "357452f2a55c999ddd3afdcbce2c339d41cf7a01613d9d45ff88a753bb82f21d",
            "45fea40d828320408f1b1c4e18d220eb201047ffbb1f078626a25b153cdfcd63",
            "2606aa0fea3624f792c70d276712a3e70d63cd190483a688b2af7e15f617ed78",
            "705e715f6edcd81c18529bbdd60dc237948235e3e6f5188bf5be058c6e86980b",
            "8c39ce2883aad8a36c4194dc053127b29efa1677cc12db45e805760c5d9f14d1"
        ],
        "globals": [
            "config",
            "_hmt",
            "control",
            "powered",
            "addRecord",
            "$",
            "jQuery",
            "jQuery112405412187683045117",
            "Swiper",
            "lib",
            "rem",
            "dpr",
            "AOS",
            "Waypoint",
            "app"
        ],
        "tls": {
            "san": [
                "m.qmh-google.com.cn",
                "qmh-google.com.cn",
                "www.qmh-google.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "qmh-google.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T04:33:16Z",
            "valid_from": "2026-10-15T04:33:17Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 75,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:56:00Z",
        "uuid": "6c8b6048-1732-4299-9b5a-becbf49dad64",
        "scanned_at": "2026-10-19T02:12:23Z",
        "final_url": "https://qmh-google.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://qmh-google.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "0dcf2bc66ca0575a05d70de74ba6a051ab173e31cc1f2e54470bfff59888119c",
        "doc_hash": "e6387cc0bf008e116efc55cc404cb63c8219900cad7e7ee5b7805676eb89bd2e",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "qmh-google.com.cn",
                "type": "A",
                "value": "160.124.216.190"
            }
        ],
        "dnssec_valid": false,
        "ip": "160.124.216.190",
        "whois": {
            "registrar": "广东时代互联科技有限公司",
            "created": "2026-09-17T22:10:08Z",
            "expires": "2027-09-17T22:10:08Z",
            "nameservers": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:07:06Z",
        "analysis_at": "2026-10-19T02:01:49Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 2,
            "suspicious": 1,
            "undetected": 37
        },
        "detections": {
            "SOCRadar": "suspicious",
            "Kaspersky": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-10-15T09:37:23Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.nowcndns.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.nowcndns.com",
                "value": "ns1.nowcndns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.nowcndns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "160.124.216.190"
            }
        ],
        "dns_at": "2026-10-19T02:07:39Z",
        "jarm": "40d40d40d00040d00043d43d00043d3bef2bf79cd6719851e8198c1e8f9a14",
        "cert": {
            "san": [
                "m.qmh-google.com.cn",
                "qmh-google.com.cn",
                "www.qmh-google.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5f6301242a4f87a990dd12c7123af02faf4",
            "sha256": "6774aa902eb778d381c83789a0797882f462b2fda1e5c5d6bfb7e6342212a73f",
            "subject": "qmh-google.com.cn",
            "valid_to": "2027-01-13T04:33:16Z",
            "valid_from": "2026-10-15T04:33:17Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.nowcndns.com",
                "ns2.nowcndns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T00:57:39Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "qmh-google.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-19T01:50:21Z",
            "first": "2026-10-19T01:50:21Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 16251
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://qmh-google.com.cn/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 8
        },
        "social_tags": {
            "ogUrl": "//qmh-google.com.cn/",
            "title": "球盟会·qmh(中国)-官方网站",
            "ogType": "website",
            "ogImage": "/uploads/ucms/logo/2024010119223913a5c26f11.png",
            "ogTitle": "球盟会·qmh(中国)-官方网站",
            "keywords": "qmh,球盟会,qm球盟会",
            "ogSiteName": "球盟会·qmh(中国)-官方网站",
            "themeColor": "#3d7acf",
            "description": "qmh,球盟会,qm球盟会,集团开创了很多全新的游戏方式,比如说多人在线联网,游戏互动等等！",
            "canonicalUrl": "//qmh-google.com.cn/",
            "ogDescription": "qmh,球盟会,qm球盟会,集团开创了很多全新的游戏方式,比如说多人在线联网,游戏互动等等！"
        },
        "trackers": {
            "requests": 67,
            "trackers": [
                {
                    "name": "Baidu Ads",
                    "company": "Baidu",
                    "country": "CN",
                    "category": "Advertising",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 691,
                "tls": 241,
                "wait": 253,
                "connect": 239,
                "download": 450
            },
            "response_ms": 1874
        },
        "tls_connection": {
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 47666,
            "co2_grams": 0.0017,
            "cleaner_than": 38
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "61.158.128.11",
                    "host": "ns2.nowcndns.com"
                },
                {
                    "ip": "218.98.111.138",
                    "host": "ns1.nowcndns.com"
                }
            ],
            "zone": "qmh-google.com.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "HMACCOUNT_BFESS",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901"
                },
                {
                    "name": "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
                    "session": true
                },
                {
                    "name": "HMACCOUNT",
                    "session": true
                }
            ]
        },
        "location": {
            "ip": "160.124.216.190",
            "asn": "132839",
            "org": "Posix Systems",
            "city": "Pretoria",
            "country": "ZA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "qmh-google.com.cn"
        },
        "dns": {
            "A": [
                "160.124.216.190"
            ],
            "NS": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ],
            "SOA": "{\"nsname\": \"ns1.nowcndns.com\", \"hostmaster\": \"admin.nowcndns.com\", \"serial\": 1792032707, \"refresh\": 3600, \"retry\": 300, \"expire\": 1209600, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "160.124.216.190",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://qmh-google.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Bootstrap",
                "Slick",
                "OWL Carousel",
                "Baidu Analytics (百度统计)",
                "Swiper",
                "jQuery",
                "AOS",
                "Open Graph"
            ]
        },
        "linked_pages": {
            "internal_count": 15
        },
        "whois": {
            "registrar": "广东时代互联科技有限公司",
            "created": "2026-09-17T20:10:08Z",
            "expires": "2027-09-17T20:10:08Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```