# PhishDestroy domain threat record: wqqyfcnm.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/wqqyfcnm.com/
Machine-readable companion: https://phishdestroy.io/domain/wqqyfcnm.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-15 16:40:09 UTC
- Last availability or vendor check: 2026-10-22 10:07:08 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 43.153.93.119
- Registrar in stored WHOIS data: Aceville Pte. Ltd.
- Last stored HTTP status: 200
- Registration date (registry RDAP, wqqyfcnm.com): 2026-09-14 06:56:21 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/wqqyfcnm.com
- Certificate Transparency search: https://crt.sh/?q=%25.wqqyfcnm.com
- Web Archive lookup: https://web.archive.org/web/*/https://wqqyfcnm.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
wqqyfcnm.com is a randomly named domain on the PhishDestroy blocklist that serves a page titled "pos-coin". The title points to a cryptocurrency or coin-themed site, so its likely audience is people looking for a token, mining or staking opportunity. PhishDestroy first saw it on 2026-09-15. As of 2026-10-19 it was still online and serving content.

How the scam works
The page title is the only clue to the site's purpose, and it shows a crypto product called "pos-coin" rather than any recognized project. Spamhaus files the domain under phishing. That makes the main risks giving up login details or other personal information, or sending cryptocurrency to a site that has no legitimate project behind it. A nonsense domain name paired with a coin-branded page is typical of short-lived sites built to collect deposits or credentials before they are reported.

Evidence
Six of 89 security engines on VirusTotal flagged the domain as of 2026-09-23. They are alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That is a minority of engines, but it comes from several unrelated vendors. Spamhaus lists the domain in its DBL under the phishing category, which is a separate and fairly strong signal. The domain also appears in three AlienVault OTX threat pulses, so other researchers have linked it to malicious activity.

Infrastructure
The domain was registered through Aceville Pte. Ltd. on 2026-09-14, and PhishDestroy picked it up the next day. A one-day gap like that suggests the site went into use almost as soon as it was registered. It is hosted on a Tencent cloud network at a US-located address. The site has a Certum domain-validated certificate, so the padlock in the browser only means the connection is encrypted. It says nothing about whether the site is trustworthy.

What to do
Do not deposit funds, buy tokens or enter credentials on wqqyfcnm.com. If you already sent crypto there, stop any further payments, including any "fee" requested to unlock a balance. Keep your transaction IDs and report the loss to your exchange and local authorities. If you entered a password, change it everywhere you reused it and turn on two-factor authentication. If you connected a wallet, revoke any token approvals granted to this site. Security teams should block the domain at DNS and proxy level and watch for other coin-themed sites registered and launched in the same rapid pattern.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/wqqyfcnm.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wqqyfcnm.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:47:27 UTC

## Stored page captures

- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6591cdb6-e27a-4959-aaf7-aa07c311c59b.png
  Captured: 2026-09-23 02:49:22 UTC
  Source report: https://radar.cloudflare.com/scan/6591cdb6-e27a-4959-aaf7-aa07c311c59b
  SHA-256: 7d33de742ab028bafbfe3dc9a71f3eed9443ec60c245f6d9a08f7f271d59da95
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a401-493e-7685-9c4b-d5fc1b9d7261.png
  Captured: 2026-09-15 07:39:12 UTC
  Source report: https://urlscan.io/result/01a0a401-493e-7685-9c4b-d5fc1b9d7261/
  SHA-256: 47983676107319a47ff80ec9a7f974ba1ca4df4451a489fac69493b9353d8517
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a401-be94-7779-81d6-cd8d99495554.png
  Captured: 2026-09-15 07:39:39 UTC
  Source report: https://urlscan.io/result/01a0a401-be94-7779-81d6-cd8d99495554/
  SHA-256: 2697042a2b1cb0f03dc43aa4cdf8115c6ef8375f6d43be25f646bb07db8874a2

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:30:10Z",
        "uuid": "6591cdb6-e27a-4959-aaf7-aa07c311c59b",
        "scanned_at": "2026-09-23T02:49:22Z",
        "final_url": "https://www.google.com/",
        "status": 200,
        "history": [
            {
                "url": "https://wqqyfcnm.com/",
                "status": 200
            },
            {
                "url": "https://www.google.com/",
                "status": 200
            }
        ],
        "dom_hash": "436ef2783ce8fb6efe1dc8c52e6b782ef2457ff5787cc8d3e82490d454243e49",
        "doc_hash": "51411e55421366fae33219817e5287c1a3c0297c6fce25f9551a9b1fa83aa42e",
        "domain_risks": [
            "Search Engines",
            "Technology",
            "News, Portal & Search"
        ],
        "radar_rank": {
            "rank": 1,
            "bucket": "200"
        },
        "dns": [
            {
                "name": "ogads-pa.clients6.google.com",
                "type": "A",
                "value": "142.251.46.74"
            },
            {
                "name": "ogads-pa.clients6.google.com",
                "type": "AAAA",
                "value": "2607:f8b0:400e:c0c::5f"
            },
            {
                "name": "play.google.com",
                "type": "A",
                "value": "142.250.73.142"
            },
            {
                "name": "play.google.com",
                "type": "AAAA",
                "value": "2607:f8b0:400a:802::200e"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.153.119"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.154.119"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.156.119"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.150.119"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.151.119"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.155.119"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.157.119"
            },
            {
                "name": "www.google.com",
                "type": "A",
                "value": "142.251.152.119"
            },
            {
                "name": "www.google.com",
                "type": "AAAA",
                "value": "2001:4860:482a:7700::"
            },
            {
                "name": "www.google.com",
                "type": "AAAA",
                "value": "2001:4860:482c:7700::"
            },
            {
                "name": "www.google.com",
                "type": "AAAA",
                "value": "2001:4860:4828:7700::"
            }
        ],
        "dnssec_valid": false,
        "ip": "142.251.153.119",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "1997-09-15T04:00:00Z",
            "updated": "2019-09-09T15:39:04Z",
            "expires": "2028-09-14T04:00:00Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T00:31:10Z",
        "analysis_at": "2026-09-23T02:00:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Malicious, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "Aceville Pte. Ltd.",
        "created": "2026-09-14T06:56:21Z",
        "expires": "2027-09-14T06:56:21Z",
        "updated": "2026-09-14T06:56:21Z",
        "first_seen": "2026-09-14T07:40:13Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "c.dnspod.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "43.153.93.119"
            },
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "domainadmin.dnspod.com",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.dnspod.com"
            }
        ],
        "dns_at": "2026-09-23T02:00:37Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "wqqyfcnm.com",
                "www.wqqyfcnm.com"
            ],
            "issuer": "Asseco Data Systems S.A. / Certum DV TLS G2 R39 CA",
            "serial": "28b1ac820bee2aa895fad48c99743d21",
            "sha256": "c4faf364e93890342e1fd43fb734294f0129f0ea4ae75e61407bc419f722f980",
            "subject": "wqqyfcnm.com",
            "valid_to": "2027-04-01T07:08:50Z",
            "valid_from": "2026-09-14T07:08:51Z"
        },
        "whois": {
            "registrar": "Aceville Pte. Ltd.",
            "registrar_iana_id": "3858",
            "registrar_url": "https://www.dnspod.com",
            "created": "2026-09-14T06:56:21Z",
            "updated": "2026-09-14T06:56:21Z",
            "expires": "2027-09-14T06:56:21Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-09-14T06:56:21Z",
                "registration": "2026-09-14T06:56:21Z",
                "last update of RDAP database": "2026-09-14T14:56:23Z"
            }
        }
    }
}
```