# PhishDestroy threat dossier — ex-onprotocol.com ================================================================ Fetched: 2026-04-18 19:13:07 UTC Canonical: https://phishdestroy.io/domain/ex-onprotocol.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 82/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Sei ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 151.101.2.15 Registrar: Name.com, Inc. Nameservers: ns1kpv.name.com, ns2cvx.name.com, ns3gnv.name.com, ns4fpy.name.com Registered: 2026-03-24 Page title: XR-VERSE | Smart Contract Ecosystem HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-06-22 Status: INVALID chain Fingerprint: f144d1e910bcc2e073df400f4e9e97dd872efe640b8c4c859fce17cc6874d5fa ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-24 (per WHOIS — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-18 17:03:38 UTC (by PhishDestroy tracker) First reported: 2026-04-18 14:03:41 UTC (abuse notice filed) Last verified: 2026-04-18 21:05:36 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019da0e5-de7c-774f-bffa-cd13e6725310/ URLQuery: https://urlquery.net/report/3b0bf7e0-02d8-47fc-929e-53d384d21014 Wayback Machine: https://web.archive.org/web/*/ex-onprotocol.com crt.sh CT logs: https://crt.sh/?q=%25.ex-onprotocol.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=ex-onprotocol.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/ex-onprotocol.com URLhaus: https://urlhaus.abuse.ch/host/ex-onprotocol.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-18 17:04:45 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies ex-onprotocol.com as an active Sei-brand impersonation phishing domain currently under investigation. The site is engineered to deceive visitors by mimicking Sei’s official branding or infrastructure, creating a credible facade that could trick users into divulging credentials, transferring assets, or installing malicious software. Initial indicators suggest this is a targeted social-engineering campaign rather than a generic scam, with threat actors leveraging Sei’s rising prominence to lure cryptocurrency users into interacting with counterfeit interfaces. The domain is flagged as high-risk due to the specificity of the impersonated entity and its active status, warranting immediate scrutiny from security teams and end users alike. Technical analysis reveals that ex-onprotocol.com resolves to IP 151.101.2.15, a Fastly endpoint often associated with content delivery networks, which adversaries occasionally abuse to host phishing pages behind legitimate infrastructure. The domain was created on March 24, 2026, a suspiciously recent registration date that aligns with the rapid deployment of impersonation campaigns. The SSL certificate is issued by Let’s Encrypt, a trusted CA, which may help the page evade browser warnings and appear legitimate to casual observers. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating low signature-based detection but not necessarily low threat potential—many modern phishing kits are designed to bypass antivirus signatures through dynamic content and short-lived domains. The registrar is Name.com, Inc., a legitimate provider that has not yet suspended the domain despite the clear misuse pattern. Mitigation steps are immediate and targeted. Users should avoid visiting ex-onprotocol.com entirely and should report the domain to their browser vendors and security teams. Blocklisting at the network level—via DNS filters (e.g., Quad9, OpenDNS), endpoint protection platforms, or corporate firewalls—is recommended using the domain name and associated IP (151.101.2.15). Organizations should alert employees and customers about this specific Sei impersonation campaign via internal channels and social media, emphasizing the importance of verifying URLs through official Sei channels before any interaction. Security teams are advised to monitor for related domains registered around the same time, check for SSL certificate reuse, and scan internal networks for any traffic to this or similar endpoints. Proactive threat hunting using IOCs such as this domain and IP can prevent initial access or data loss. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260418-205F64 Favicon MD5: 775456a04e36a43e3ab2bc160d84569d TLS cert SHA-256: f144d1e910bcc2e073df400f4e9e97dd872efe640b8c4c859fce17cc6874d5fa ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/ex-onprotocol.com/ JSON API: https://api.destroy.tools/v1/check?domain=ex-onprotocol.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io