# PhishDestroy domain threat record: qmh-yahoo.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/qmh-yahoo.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/qmh-yahoo.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-15 14:59:31 UTC
- Last availability or vendor check: 2026-10-22 10:42:07 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: yahoo

## Stored infrastructure

- Observed IP address: 172.247.153.72
- Registrar in stored WHOIS data: 广东时代互联科技有限公司
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-17 20:10:09 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a14011-7c10-774a-a79a-d1d0d1549ebf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/qmh-yahoo.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.qmh-yahoo.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://qmh-yahoo.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
qmh-yahoo.com.cn is an impersonation phishing page that borrows the Yahoo brand in its domain name to look trustworthy to Chinese-speaking visitors. PhishDestroy first saw it on 2026-10-15. As of 2026-10-19 the site was alive and serving live content. The page title reads "球盟会·qmh(中国)-官方网站", which presents a Chinese "official website" for a brand called qmh rather than Yahoo, while we classify the domain as Yahoo impersonation.

How the scam works
Impersonation sites like this pair a familiar brand with an unrelated name so that a link in a message, ad or search result looks legitimate at a glance. Once visitors are on the page, they are pushed to register, log in or submit personal and payment details under the banner of an "official" service. Anything entered goes straight to the operators. Victims can lose account credentials, personal information and any money they deposit or send, and stolen logins are often reused against other services.

Evidence
On 2026-10-19, VirusTotal showed 6 of 92 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That detection rate is still modest, so many security tools may not block it yet. The domain is listed on the PhishDestroy, MetaMask and SEAL blocklists. It also appears in 4 AlienVault OTX threat pulses.

Infrastructure
The domain was registered on 2026-09-17 through 广东时代互联科技有限公司, less than a month before PhishDestroy detected it. It resolves to 172.247.153.72 on POWERLINE-AS-AP (POWER LINE DATACENTER) in Hong Kong. Its TLS certificate comes from Let's Encrypt (YE1), so the padlock in the browser says nothing about whether the site is legitimate.

What to do
Do not enter any information on this site, and close it if you land there. If you created an account or typed a password, change that password right away, along with any account that shares it. Enable two-factor authentication on your real Yahoo and email accounts. If you submitted card or bank details, contact your bank to block the card and dispute any charges. Defenders should block the domain and its IP at DNS, proxy and email gateways, search logs for past visits, and report it to the registrar and hosting provider for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14011-7c10-774a-a79a-d1d0d1549ebf/
VirusTotal report: https://www.virustotal.com/gui/domain/qmh-yahoo.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=qmh-yahoo.com.cn
Archived copy: https://web.archive.org/web/20261015150027/https://qmh-yahoo.com.cn/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:22:55 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a14011-7c10-774a-a79a-d1d0d1549ebf.png
  Captured: 2026-10-15 14:59:31 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a14011-7c10-774a-a79a-d1d0d1549ebf.png
  Captured: 2026-10-15 14:59:31 UTC
  Source report: https://urlscan.io/result/01a14011-7c10-774a-a79a-d1d0d1549ebf/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f21b2b97-899e-4e9a-b1bb-3635abe915a5.png
  Captured: 2026-10-15 15:31:20 UTC
  Source report: https://radar.cloudflare.com/scan/f21b2b97-899e-4e9a-b1bb-3635abe915a5
  SHA-256: 415ab8ca1bc18bc4d96ca47c54144b6cdab8e809b39e58e89320b3e0c1546647
- URLQuery: https://screenshots.phishdestroy.io/uq/c370115b-cf71-4bf8-be46-554aa5f3a6c2.png
  Source report: https://urlquery.net/report/c370115b-cf71-4bf8-be46-554aa5f3a6c2
  SHA-256: 139d73765d35da607d608ca9457a96a27f292340ae9b56279cf2badabc42189d
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a1400f-7870-769e-bec3-a7cf74526011.png
  Captured: 2026-10-15 14:55:27 UTC
  Source report: https://urlscan.io/result/01a1400f-7870-769e-bec3-a7cf74526011/
  SHA-256: 5a60c449a04db5a9309aef73400cc7c1490c4b00d8406ef08dd19576272021e9
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a143f9-3b95-722a-bc00-469d46f8756c.png
  Captured: 2026-10-16 09:09:48 UTC
  Source report: https://urlscan.io/result/01a143f9-3b95-722a-bc00-469d46f8756c/
  SHA-256: 6d32671cc14588653f0cad9774a62d0bb2396d72d5c7f43c88997c9f78a78d29
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1450c-23a5-747b-8864-dcaf7fe9fbc8.png
  Captured: 2026-10-16 14:10:01 UTC
  Source report: https://urlscan.io/result/01a1450c-23a5-747b-8864-dcaf7fe9fbc8/
  SHA-256: fb3b7cd0ff80a5035f3154d5b690d4153368232510fe118f92f6e7911f35dd9c
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14888-5ed4-71ec-a5f8-a7ada074c0ba.png
  Captured: 2026-10-17 06:24:30 UTC
  Source report: https://urlscan.io/result/01a14888-5ed4-71ec-a5f8-a7ada074c0ba/
  SHA-256: bdc073ca4716b6cb13a63999fcc7d1a053381a604cc158bed9c521deae8377b4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:47:22Z",
        "uuid": "01a14011-7c10-774a-a79a-d1d0d1549ebf",
        "scanned_at": "2026-10-15T14:57:46Z",
        "final_url": "https://qmh-yahoo.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://qmh-yahoo.com.cn/",
                "from": "http://qmh-yahoo.com.cn/",
                "status": 307
            }
        ],
        "ip": "172.247.153.72",
        "domains": [
            "hm.baidu.com",
            "cdnjs.cloudflare.com",
            "rb9177.com",
            "rb3289.com",
            "ue6906.com",
            "ue1912.com",
            "lwhuzi.com",
            "lw1616.com",
            "th6241.com",
            "wj1903.com",
            "qmjiayu.com",
            "qm8051.com",
            "qy3507.com",
            "qycion.com",
            "jx1638.com",
            "jx3256.com"
        ],
        "ips": [
            "111.45.11.83",
            "104.17.25.14",
            "172.247.153.72"
        ],
        "asns": [
            "9808",
            "13335",
            "132839"
        ],
        "countries": [
            "CN",
            "US"
        ],
        "link_domains": [
            "qyh999.com",
            "qyh918.com",
            "jx3256.com",
            "qy3507.com",
            "qm8051.com",
            "th6241.com",
            "lwhuzi.com",
            "ue6906.com",
            "rb3289.com",
            "lw1616.com",
            "qycion.com"
        ],
        "doc_hash": "76f40ba8329c495c1b5932404f527bb26251216af3714e34e0b7564fdb3057f8",
        "script_hashes": [
            "f5fb486d940cbb553e2811c06881398badb30d072341714d44953adc8105baa7",
            "19ab38c7c5e6f8cae665446489c82bfbd9e4b4621367f1009ea902a4b9b77b50",
            "900fb11afa49e0dabb267232438aad19b736d52bee903fab08008b582c755524",
            "8cc4e1ed293f6a11601fb6345e546410af306a0d30b9ad9dbd0a8ebbe8c9e051"
        ],
        "globals": [
            "_hmt",
            "_bdhm_loaded_bf8061ca73eaa705ec626f7edd51c901",
            "mini_tangram_log_ow0yxy"
        ],
        "cookies": [
            "HMACCOUNT_BFESS",
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
            "HMACCOUNT",
            "Hm_lvt_329a636047682dfecc9be43978082a1e",
            "Hm_lpvt_329a636047682dfecc9be43978082a1e"
        ],
        "storage_keys": [
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
            "HMACCOUNT",
            "Hm_unsent_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lpvt_329a636047682dfecc9be43978082a1e",
            "Hm_unsent_329a636047682dfecc9be43978082a1e",
            "Hm_lvt_329a636047682dfecc9be43978082a1e"
        ],
        "tls": {
            "san": [
                "m.qmh-yahoo.com.cn",
                "qmh-yahoo.com.cn",
                "www.qmh-yahoo.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "qmh-yahoo.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T03:55:41Z",
            "valid_from": "2026-10-15T03:55:42Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 52,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:00:00Z",
        "uuid": "f21b2b97-899e-4e9a-b1bb-3635abe915a5",
        "scanned_at": "2026-10-15T15:31:20Z",
        "final_url": "https://qmh-yahoo.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://qmh-yahoo.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "fce57a99c65f72c044410009bd8758723d08d76212a35e1a1d874b7a89ada837",
        "doc_hash": "3c328bf096158cf6a8e0e130610ae0faecbfb89299e48be3e4c059a9a55edd75",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "qmh-yahoo.com.cn",
                "type": "A",
                "value": "172.247.153.72"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.247.153.72",
        "whois": {
            "registrar": "广东时代互联科技有限公司",
            "created": "2026-09-17T22:10:09Z",
            "expires": "2027-09-17T22:10:09Z",
            "nameservers": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T21:11:17Z",
        "analysis_at": "2026-10-19T16:25:09Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-10-15T12:32:02Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "172.247.153.72"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.nowcndns.com",
                "value": "ns1.nowcndns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.nowcndns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.nowcndns.com"
            }
        ],
        "dns_at": "2026-10-19T16:25:37Z",
        "jarm": "40d40d40d00040d00043d43d00043d3bef2bf79cd6719851e8198c1e8f9a14",
        "cert": {
            "san": [
                "m.qmh-yahoo.com.cn",
                "qmh-yahoo.com.cn",
                "www.qmh-yahoo.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6e330091fe8e76aa0e64aada2502089dac",
            "sha256": "2415af94b66260c1e19f3ec1109eec737e75ed41dd84842c386e6e2726ed1c45",
            "subject": "qmh-yahoo.com.cn",
            "valid_to": "2027-01-13T03:55:41Z",
            "valid_from": "2026-10-15T03:55:42Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.nowcndns.com",
                "ns2.nowcndns.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```