# PhishDestroy domain threat record: quicknode.fnvalley.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/quicknode.fnvalley.com/
Machine-readable companion: https://phishdestroy.io/domain/quicknode.fnvalley.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 02:22:43 UTC
- Last availability or vendor check: 2026-10-28 11:46:11 UTC
- Stored record updated: 2026-10-28 11:46:11 UTC
- VirusTotal detections in the stored snapshot: 8/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 103.82.212.167
- Registrar in stored WHOIS data: Gname.com Pte. Ltd.
- Registrar country in stored WHOIS data: CN
- Registration date (registry RDAP, fnvalley.com): 2018-06-21 05:39:23 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1668f-9967-77d9-8c95-f36a158a4d58/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/quicknode.fnvalley.com
- Certificate Transparency search: https://crt.sh/?q=%25.quicknode.fnvalley.com
- Web Archive lookup: https://web.archive.org/web/*/https://quicknode.fnvalley.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the page as malicious because it claims to be QuickNode while residing on the unrelated fnvalley.com subdomain. The recorded page title is "QuickNode" and the visible text includes a QuickNode‑branded LiveChat prompt. The domain was first seen by PhishDestroy on 2026-10-23 and returned an HTTP 200 response at that time.

How the scam works
Brand‑impersonation phishing creates a counterfeit site that mimics a legitimate service to lure visitors into entering credentials, API keys, or authorising wallet connections. Victims who trust the QuickNode brand may inadvertently disclose sensitive information that attackers can use to access or drain accounts.

Evidence
VirusTotal scanned the domain on 2026-10-23 and reported zero detections from 92 engines. Google Safe Browsing checked on 2026-10-23 and did not flag the site. External blocklists MetaMask and SEAL each listed the domain, giving two external hits. urlscan.io captured the page on 2026-10-23 and returned a malicious verdict with a 100 % phishing score. PhishDestroy’s internal blocklist also marks the domain as malicious, and OTX recorded no pulses.

Infrastructure
The subdomain resolves to IP 66.203.148.87 (also recorded as 103.82.212.167) on a network identified as RACKFLARELIMITED in Hong Kong. TLS was issued by Let’s Encrypt on 2026-10-21 and is valid until 2027-01-19. The domain age is 1 day, while the apex domain has been registered for over eight years, and the DNS records include a CNAME to 7q96dekc.as66588.com.

What to do
Do not enter any QuickNode credentials, API keys, or wallet information on this site and advise others to avoid it. Report the URL to QuickNode’s security team and to standard phishing‑reporting services. Network defenders should block quicknode.fnvalley.com at firewalls or proxies and monitor logs for connections to the recorded IP addresses.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1668f-9967-77d9-8c95-f36a158a4d58/
Cloudflare Radar report: https://radar.cloudflare.com/scan/6550e7bf-c45a-421b-9f3c-3f5615bb37a6
Stored capture screenshot: https://i.ibb.co/BVdtk2dv/a6beecc51981.png
VirusTotal report: https://www.virustotal.com/gui/domain/quicknode.fnvalley.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=quicknode.fnvalley.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 03:08:15 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/BVdtk2dv/a6beecc51981.png
  Captured: 2026-10-23 02:22:43 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1668f-9967-77d9-8c95-f36a158a4d58.png
  Captured: 2026-10-23 02:22:43 UTC
  Source report: https://urlscan.io/result/01a1668f-9967-77d9-8c95-f36a158a4d58/
- URLQuery: https://screenshots.phishdestroy.io/uq/3ea074fb-a30e-45df-9b8f-9817fb05535c.png
  Source report: https://urlquery.net/report/3ea074fb-a30e-45df-9b8f-9817fb05535c
  SHA-256: 1b25d0b3bb8dfa5aca29d882871b3235c4fee8e71ccaccca1bcc5a3a48dc639a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T03:07:06Z",
        "uuid": "01a1668f-9967-77d9-8c95-f36a158a4d58",
        "scanned_at": "2026-10-23T02:21:26Z",
        "final_url": "https://quicknode.fnvalley.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://quicknode.fnvalley.com/",
                "from": "http://quicknode.fnvalley.com/",
                "status": 307
            }
        ],
        "ip": "66.203.148.87",
        "domains": [
            "cdn.livechatinc.com",
            "api.283sgrc.com",
            "api.livechatinc.com",
            "cdn.dcloud.net.cn",
            "accounts.livechatinc.com",
            "secure.livechatinc.com"
        ],
        "ips": [
            "124.174.83.126",
            "2.20.142.25",
            "23.36.162.17",
            "18.163.60.221",
            "23.53.42.242",
            "2.20.143.83",
            "23.36.162.25",
            "66.203.148.87"
        ],
        "asns": [
            "137718",
            "20940",
            "16509",
            "59371"
        ],
        "countries": [
            "CN",
            "DE",
            "HK"
        ],
        "doc_hash": "dc458e53e0ca664b52cf8cddff02714607c92dbebf9855744ec8d3ecf5441d94",
        "script_hashes": [
            "a5b9252579ddfddf0647c37aa26653fa119331b91c521e760be3642cf355901c",
            "aac9038ccb5c2eea529ef2aae75563a089f8e24938658e7a89aa45b42d2a477b",
            "18bcc71c6c2b69450dfa12dca7e8c275d26219207254875e5c82b868234b50e2"
        ],
        "globals": [
            "__lc",
            "LiveChatWidget",
            "__lc_inited",
            "LC_API",
            "webpackJsonp",
            "__uniConfig",
            "__uniRoutes",
            "UniApp",
            "UniViewJSBridge",
            "UniServiceJSBridge",
            "uni",
            "wx",
            "getApp",
            "getCurrentPages"
        ],
        "cookies": [
            "__lc_cid",
            "__lc_cst",
            "__oauth_redirect_detector",
            "__uni__uid"
        ],
        "storage_keys": [
            "__test_storage_support__",
            "__DC_STAT_UUID",
            "authIng",
            "UNI-APP-CRMEB:TAG",
            "sysConfig"
        ],
        "tls": {
            "san": [
                "quicknode.fnvalley.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "quicknode.fnvalley.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T06:32:06Z",
            "valid_from": "2026-10-21T06:32:07Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 3034,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 53,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 77,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "generic"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T03:07:08Z",
        "uuid": "6550e7bf-c45a-421b-9f3c-3f5615bb37a6",
        "scanned_at": "2026-10-23T03:02:40Z",
        "final_url": "https://quicknode.fnvalley.com/",
        "status": 200,
        "history": [
            {
                "url": "https://quicknode.fnvalley.com/",
                "status": 200
            }
        ],
        "dom_hash": "f2ecc00fc6476c8032db850ee07c2e652db1b19434ce24b2ada7260dfb8d7756",
        "doc_hash": "dc458e53e0ca664b52cf8cddff02714607c92dbebf9855744ec8d3ecf5441d94",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "quicknode.fnvalley.com",
                "type": "CNAME",
                "value": "7q96dekc.as66588.com"
            },
            {
                "name": "quicknode.fnvalley.com",
                "type": "CNAME",
                "value": "7q96dekc.as66588.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "66.203.148.87",
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2018-06-21T05:39:23Z",
            "updated": "2026-10-21T07:27:01Z",
            "expires": "2027-06-21T05:39:23Z",
            "nameservers": [
                "a9.share-dns.com",
                "b9.share-dns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T03:01:31Z",
        "analysis_at": "2026-10-23T02:42:50Z",
        "stats": {
            "timeout": 0,
            "harmless": 0,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 92
        },
        "reputation": 0,
        "registrar": "Gname.com Pte. Ltd.",
        "created": "2018-06-21T05:39:23Z",
        "expires": "2027-06-21T05:39:23Z",
        "updated": "2026-10-21T07:27:08Z",
        "first_seen": "2026-10-21T09:43:00Z",
        "dns": [
            {
                "ttl": 600,
                "type": "CNAME",
                "value": "7q96dekc.as66588.com"
            },
            {
                "ttl": 599,
                "type": "CNAME",
                "value": "7q96dekc.as66588.com"
            },
            {
                "ttl": 59,
                "type": "CNAME",
                "value": "xaeyrs6b.as66588.com"
            },
            {
                "ttl": 60,
                "type": "CNAME",
                "value": "xaeyrs6b.as66588.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "66.203.148.87"
            }
        ],
        "dns_at": "2026-10-23T02:48:13Z",
        "jarm": "29d29d00029d29d21c42d42d000000c1fc3d47ef34532079f4922fcb05ef65",
        "cert": {
            "san": [
                "quicknode.fnvalley.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "5e38139c13844349abb85675c19560150a9",
            "sha256": "d2b2a92e25faa2f2fefb8f4db6af751b36b80f28831616a32821c6670f2c77d6",
            "subject": "quicknode.fnvalley.com",
            "valid_to": "2027-01-19T06:32:06Z",
            "valid_from": "2026-10-21T06:32:07Z"
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "registrar_iana_id": "1923",
            "registrar_url": "http://www.gname.com",
            "created": "2018-06-21T05:39:23Z",
            "updated": "2026-10-21T07:27:01Z",
            "expires": "2027-06-21T05:39:23Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a9.share-dns.com",
                "b9.share-dns.net"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T03:07:30Z",
        "caa_records": {
            "domain": "quicknode.fnvalley.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T02:25:26Z",
            "first": "2026-10-23T02:25:26Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1598
        },
        "social_tags": {
            "title": "QuickNode"
        },
        "trackers": {
            "requests": 48,
            "trackers": [
                {
                    "name": "LiveChat",
                    "company": "LiveChat",
                    "category": "Customer Interaction",
                    "requests": 22
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 203,
                "wait": 177,
                "connect": 172,
                "download": 0
            },
            "response_ms": 554
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 1830,
            "co2_grams": 0.0001,
            "cleaner_than": 95
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__uni__uid",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "66.203.148.87",
            "asn": "59371",
            "org": "Dimension Network & Communication Limited",
            "city": "Chai Wan Kok",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "quicknode.fnvalley.com"
        },
        "dns": {
            "A": [
                "66.203.148.87"
            ],
            "CNAME": [
                "7q96dekc.as66588.com"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "66.203.148.87",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://quicknode.fnvalley.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Vue.js",
                "Nginx",
                "LiveChat",
                "core-js",
                "HSTS",
                "Webpack"
            ]
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2018-06-21T05:39:23Z",
            "updated": "2026-10-21T07:27:01Z",
            "expires": "2027-06-21T05:39:23Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "a9.share-dns.com",
                "b9.share-dns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```