# PhishDestroy domain threat record: rainbowqqz.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rainbowqqz.com/
Machine-readable companion: https://phishdestroy.io/domain/rainbowqqz.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 16:17:24 UTC
- Stored record updated: 2026-10-26 21:11:07 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.200.58
- Registrar in stored WHOIS data: NameMart Pte. Ltd.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-05-30 11:53:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16d1f-4e84-73cf-81ff-83fc3de6acaf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rainbowqqz.com
- Certificate Transparency search: https://crt.sh/?q=%25.rainbowqqz.com
- Web Archive lookup: https://web.archive.org/web/*/https://rainbowqqz.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added rainbowqqz.com to its internal blocklist on 2026-10-26 after an automated intake flagged a VirusTotal malicious label. The intake noted insufficient page content for analysis, so no specific page title or content was recorded. A later fetch on the same day returned HTTP 200 with no redirect.

How the scam works
The current evidence does not demonstrate a concrete phishing or fraud mechanism; the domain is simply flagged because a security engine labeled it malicious. Domains with similar detections are often used to host deceptive pages that harvest credentials or lure users, but no such behavior was observed on this site.

Evidence
VirusTotal reported 1 malicious detection out of 92 engines on 2026-10-23, with LevelBlue classifying the domain as phishing; the result was retrieved on 2026-10-26. Google Safe Browsing checked the domain on 2026-10-26 and returned no warning. urlscan.io captured the site on 2026-10-24, gave an overall clean verdict but its engine score was 94 with malicious tags; the scan was retrieved on 2026-10-26. OTX listed one pulse referencing the domain as of 2026-10-26. PhishDestroy’s internal blocklist marks the domain as blocked, while external blocklists checked on 2026-10-26 reported zero hits.

Infrastructure
The domain was registered with NameMart Pte. Ltd. on 2026-05-30 and expires on 2027-05-30. A recorded DNS lookup on 2026-10-23 returned Cloudflare IPs 104.21.68.235 and 172.67.200.58, with nameservers clyde.ns.cloudflare.com and lia.ns.cloudflare.com; DNSSEC was not enabled. The certificate check found a Let’s Encrypt TLS certificate valid from 2026-09-25 to 2026-12-24. A web check on 2026-10-26 indicated the presence of Cloudflare’s web application firewall.

What to do
If you visited the site, avoid entering any credentials or personal information and monitor related accounts for unexpected activity. Network defenders should block outbound connections to rainbowqqz.com and consider adding the domain to threat‑intel feeds. Continue to watch for any future changes in reputation from VirusTotal, Google Safe Browsing, or other sources.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16d1f-4e84-73cf-81ff-83fc3de6acaf/
Cloudflare Radar report: https://radar.cloudflare.com/scan/d489221e-6740-4dbe-8157-412996d33bc4
Stored capture screenshot: https://urlscan.io/screenshots/01a16d1f-4e84-73cf-81ff-83fc3de6acaf.png
Cloudflare Radar screenshot (2026-10-26T16:31:47Z): https://screenshots.phishdestroy.io/cf/d489221e-6740-4dbe-8157-412996d33bc4.png
URLScan screenshot (2026-10-23T18:58:12Z): https://screenshots.phishdestroy.io/us/01a16a20-9a8c-743e-bc79-23db333d2258.png
URLScan capture report: https://urlscan.io/result/01a16a20-9a8c-743e-bc79-23db333d2258/
URLScan screenshot (2026-10-23T19:31:14Z): https://screenshots.phishdestroy.io/us/01a16a3e-b511-718a-91c1-ccca324afa95.png
URLScan capture report: https://urlscan.io/result/01a16a3e-b511-718a-91c1-ccca324afa95/
URLScan screenshot (2026-10-26T16:32:18Z): https://screenshots.phishdestroy.io/us/01a1790e-1a92-777b-bf7d-f9787d0acc19.png
URLScan capture report: https://urlscan.io/result/01a1790e-1a92-777b-bf7d-f9787d0acc19/
VirusTotal report: https://www.virustotal.com/gui/domain/rainbowqqz.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rainbowqqz.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 16:41:39 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16d1f-4e84-73cf-81ff-83fc3de6acaf.png
  Captured: 2026-10-26 16:17:24 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a16d1f-4e84-73cf-81ff-83fc3de6acaf.png
  Source report: https://urlscan.io/result/01a16d1f-4e84-73cf-81ff-83fc3de6acaf/
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a20-9a8c-743e-bc79-23db333d2258.png
  Captured: 2026-10-23 18:58:12 UTC
  Source report: https://urlscan.io/result/01a16a20-9a8c-743e-bc79-23db333d2258/
  SHA-256: 387dbd3bcb7312f9871210f059bb9fac22bb36c52e7dc8ec63a690f47fbac8fa
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a3e-b511-718a-91c1-ccca324afa95.png
  Captured: 2026-10-23 19:31:14 UTC
  Source report: https://urlscan.io/result/01a16a3e-b511-718a-91c1-ccca324afa95/
  SHA-256: aee41cfd9231fc695c1d43b28f199e97522984c5178874135ca9e6acd0a480dc
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1790e-1a92-777b-bf7d-f9787d0acc19.png
  Captured: 2026-10-26 16:32:18 UTC
  Source report: https://urlscan.io/result/01a1790e-1a92-777b-bf7d-f9787d0acc19/
  SHA-256: 244ea986f99caaed24708f4a4b19bac0c31b070c4054e40fa6b06849c8963426
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d489221e-6740-4dbe-8157-412996d33bc4.png
  Captured: 2026-10-26 16:31:47 UTC
  Source report: https://radar.cloudflare.com/scan/d489221e-6740-4dbe-8157-412996d33bc4
  SHA-256: 3f389a316ece2e7249617f8b027bfdefe7b3727286b6d4981b5c0f37a29f9c84

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:12Z",
        "uuid": "01a16d1f-4e84-73cf-81ff-83fc3de6acaf",
        "scanned_at": "2026-10-24T08:55:39Z",
        "final_url": "https://rainbowqqz.com/",
        "status": 200,
        "ip": "104.21.68.235",
        "domains": [
            "kf.dl237x.com",
            "ooudessd.oss-ap-southeast-1.aliyuncs.com",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "47.79.48.159",
            "8.212.161.30",
            "104.16.80.73",
            "104.21.68.235"
        ],
        "asns": [
            "45102",
            "13335"
        ],
        "countries": [
            "SG",
            "PH"
        ],
        "doc_hash": "075f7b4899b2ecb2aadd008a11360ae045928b7198718305235a9eb1ec216879",
        "script_hashes": [
            "cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151",
            "a910bf0ee13b6ae8b84f074f1c24813c0ead3dc4895ac10ec568db2567b78f94",
            "3904b25aa15a4303ab011fed504bff10853457942b3c23f4121c8b2889e4a077",
            "ee978c61974d99ef8b6d6d466e20f39cea8d0b8c084bcb9a1e2568042a1048c1",
            "376c7340bb190e57b6334073d3464f7fb12b35bec64ff341bb11c434d520ae9f",
            "38251667d5c03b9824ecce843923170e0dae19c887b67bd358b89c2e749fdbe3",
            "4699b2fed3971cb880e458e5a6d9d72182ab200f6ce97653656686d0c3e6225f"
        ],
        "globals": [
            "TradingView",
            "addLink",
            "addMeta",
            "lib",
            "rem",
            "dpr",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "setImmediate",
            "clearImmediate",
            "PubSub",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser",
            "__cfBeacon",
            "chatwootSDK",
            "chatwootSettings",
            "$chatwoot"
        ],
        "cookies": [
            "p_uv_id"
        ],
        "storage_keys": [
            "rainbow_THEME",
            "main",
            "rainbow_LANGUAGE"
        ],
        "tls": {
            "san": [
                "*.rainbowqqz.com",
                "rainbowqqz.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "rainbowqqz.com",
            "protocol": "QUIC",
            "valid_to": "2026-12-24T23:46:57Z",
            "valid_from": "2026-09-25T23:46:58Z"
        },
        "domain_age_days": 146,
        "apex_age_days": 146,
        "tls_age_days": 28,
        "tls_valid_days": 89,
        "requests": 106,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:19Z",
        "uuid": "d489221e-6740-4dbe-8157-412996d33bc4",
        "scanned_at": "2026-10-26T16:31:47Z",
        "final_url": "https://rainbowqqz.com/",
        "status": 200,
        "history": [
            {
                "url": "https://rainbowqqz.com/",
                "status": 200
            }
        ],
        "dom_hash": "c6a92ec8ce83a2052470f53f9769427d97352493d0114a6e8af74121a91340fa",
        "doc_hash": "075f7b4899b2ecb2aadd008a11360ae045928b7198718305235a9eb1ec216879",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rainbowqqz.com",
                "type": "A",
                "value": "104.21.68.235"
            },
            {
                "name": "rainbowqqz.com",
                "type": "A",
                "value": "172.67.200.58"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.68.235",
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "created": "2026-05-30T13:53:00Z",
            "updated": "2026-05-30T14:21:00Z",
            "expires": "2027-05-30T13:53:00Z",
            "nameservers": [
                "clyde.ns.cloudflare.com",
                "lia.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:28:09Z",
        "analysis_at": "2026-10-23T19:14:01Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "LevelBlue": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "NameMart Pte. Ltd.",
        "created": "2026-05-30T13:53:00Z",
        "expires": "2027-05-30T13:53:00Z",
        "updated": "2026-05-30T14:21:00Z",
        "first_seen": "2026-05-31T02:07:50Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "clyde.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.68.235"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "clyde.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.200.58"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lia.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-23T19:19:36Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.rainbowqqz.com",
                "rainbowqqz.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "59d67853bd04e5a8f3205a7d7c7bb8076b4",
            "sha256": "7703a73432b13034176f2e9694c5d0cc2f1966c7afc9cec3d826ae56e6735bfa",
            "subject": "rainbowqqz.com",
            "valid_to": "2026-12-24T23:46:57Z",
            "valid_from": "2026-09-25T23:46:58Z"
        },
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "registrar_iana_id": "4162",
            "registrar_url": "https://www.namemart.com",
            "created": "2026-05-30T13:53:00Z",
            "updated": "2026-05-30T14:21:00Z",
            "expires": "2027-05-30T13:53:00Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "clyde.ns.cloudflare.com",
                "lia.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "registration": "2026-05-30T13:53:00Z",
                "registrar expiration": "2027-05-30T13:53:00Z",
                "last update of RDAP database": "2026-05-30T22:21:01Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:41:17Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "rainbowqqz.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:23:02Z",
            "first": "2026-10-26T16:23:02Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 9269
        },
        "social_tags": {
            "robots": "all",
            "ogImage": "/platform/dev/logo_144.png?2.0.1772439726270",
            "themeColor": "#ffffff"
        },
        "trackers": {
            "requests": 16
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 5,
                "tls": 57,
                "wait": 444,
                "connect": 6,
                "download": 0
            },
            "response_ms": 512
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 15160,
            "co2_grams": 0.0006,
            "cleaner_than": 63
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.185",
                    "host": "lia.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.91",
                    "host": "clyde.ns.cloudflare.com"
                }
            ],
            "zone": "rainbowqqz.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "p_uv_id",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "104.21.68.235",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "rainbowqqz.com"
        },
        "dns": {
            "A": [
                "172.67.200.58",
                "104.21.68.235"
            ],
            "NS": [
                "clyde.ns.cloudflare.com",
                "lia.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"clyde.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415869236, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "172.67.200.58",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://rainbowqqz.com"
            ]
        },
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "created": "2026-05-30T13:53:00Z",
            "updated": "2026-05-30T14:21:00Z",
            "expires": "2027-05-30T13:53:00Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "clyde.ns.cloudflare.com",
                "lia.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```