# PhishDestroy domain threat record: sessionproj626.onrender.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/sessionproj626.onrender.com/ Machine-readable companion: https://phishdestroy.io/domain/sessionproj626.onrender.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 08:03:49 UTC - Last availability or vendor check: 2026-10-22 10:12:32 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 15/89 - Independent public blocklist matches in the stored snapshot: 3 - Matching public blocklists: MetaMask, ScamSniffer, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: opensea ## Stored infrastructure - Observed IP address: 216.24.57.7 - Registrar in stored WHOIS data: Render Services Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, onrender.com): 2015-03-28 01:20:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a056d7-4612-70a8-b8ea-34236b3fff64/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/sessionproj626.onrender.com - Certificate Transparency search: https://crt.sh/?q=%25.sessionproj626.onrender.com - Web Archive lookup: https://web.archive.org/web/*/https://sessionproj626.onrender.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview sessionproj626.onrender.com is a fake NFT minting and marketplace site that impersonates OpenSea, the largest NFT trading platform, to deceive collectors and crypto users. The page presents itself under the title "OpenSea.io" to appear legitimate at a glance. PhishDestroy first flagged it on 2026-08-31, and as of 2026-10-19 the site remains fully live with active content. How the scam works The site mimics OpenSea's interface to lure victims into connecting their crypto wallets and approving a transaction under the pretense of minting or purchasing an NFT. Once the wallet is connected and a transaction is signed, malicious contract calls drain the victim's NFT holdings or fungible tokens — or both — without delivering any legitimate asset in return. Victims typically lose whatever they approve in that single interaction, with no recourse after the transaction is confirmed on-chain. Revoking any wallet approvals granted during a visit is essential to prevent further losses. Evidence Fifteen of 89 security engines on VirusTotal flagged this domain as malicious as of 2026-09-14, with detections from BitDefender, ESET, Emsisoft, Fortinet, G-Data, Ermes, Forcepoint ThreatSeeker, and alphaMountain.ai among others. urlscan.io independently returned a malicious verdict and identified OpenSea as the impersonated brand. The domain appears on four blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL, giving it broad coverage across wallet-level and community threat feeds. Infrastructure The subdomain runs on Render's platform under the onrender.com namespace, registered through Render Services Inc. since 2015-03-28, with hosting on IP 216.24.57.7 within Render's US-based network. The TLS certificate is issued by Google Trust Services under the WE1 authority, which is standard for Render-hosted applications and lends the site a superficially trustworthy HTTPS padlock. What to do If you visited this site and connected your wallet, immediately revoke all token and NFT approvals using a trusted approval-management tool, and transfer assets to a fresh wallet address. Do not sign any pending transactions originating from this domain. If you entered any credentials or personal information, treat them as compromised. Security teams and wallet providers should ensure this domain is blocked at the network and application layer; the MetaMask, ScamSniffer, and SEAL blocklist entries can be used as reference for automated enforcement. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a056d7-4612-70a8-b8ea-34236b3fff64/ VirusTotal report: https://www.virustotal.com/gui/domain/sessionproj626.onrender.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sessionproj626.onrender.com Archived copy: https://web.archive.org/web/20260831080834/https://sessionproj626.onrender.com/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 08:51:10 UTC ## Stored page captures - Primary capture: https://i.ibb.co/zT9ryNyw/feca5b46874d.png Captured: 2026-08-31 08:03:49 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a056d7-4612-70a8-b8ea-34236b3fff64.png Captured: 2026-08-31 08:03:49 UTC Source report: https://urlscan.io/result/01a056d7-4612-70a8-b8ea-34236b3fff64/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:26:34Z", "uuid": "01a056d7-4612-70a8-b8ea-34236b3fff64", "scanned_at": "2026-08-31T08:02:31Z", "final_url": "https://sessionproj626.onrender.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://sessionproj626.onrender.com/", "from": "http://sessionproj626.onrender.com/", "status": 307 } ], "ip": "216.24.57.15", "ptr": "ip-216-24-57-15.ingress.render.com", "domains": [ "api.web3modal.org", "bright-code-4b1.cf-y35xxr4b.workers.dev", "api.ipify.org", "cdnjs.cloudflare.com", "arbitrum.drpc.org", "arbitrum-one.publicnode.com", "arb1.arbitrum.io", "pulse.walletconnect.org", "fonts.googleapis.com", "secure.walletconnect.org", "cdn.jsdelivr.net", "projectmints8332.vercel.app", "arbitrum.llamarpc.com" ], "ips": [ "2a00:1450:4001:c15::5f", "104.18.18.237", "172.66.157.155", "2a04:4e42:f000::485", "104.26.13.205", "104.17.24.14", "172.67.181.66", "104.18.11.59", "172.66.150.162", "2606:4700:10::6814:2760", "216.198.79.131", "216.24.57.15" ], "asns": [ "15169", "13335", "54113", "16509", "397273" ], "countries": [ "DE", "US" ], "link_domains": [ "etherscan.io", "discord.com", "x.com", "www.reddit.com", "www.instagram.com", "t.me" ], "social": [ "https://discord.com/invite/opensea", "https://x.com/opensea_support", "https://www.instagram.com/opensea", "https://t.me/Freemints_help" ], "doc_hash": "78e7bd94d8482e166c26b7b6b0d3b32cc7e598aad69af166ef9b1c816b5491ee", "script_hashes": [ "987cbf0af43ae101f58da830f28547c60cc01d5c3f4080564a9f35312e833055" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "qEhPf0v", "a", "gpOt5r", "b", "__globalObject", "__TextDecoder", "__Uint8Array", "__String", "__Array", "utf8ArrayToStr", "c", "LSeWMw3", "egk4osj", "d", "Av36kxX", "NlcUHh", "e", "e1ag1xkgv1", "a4acfbff6a", "d731da07b47b", "b6822051", "ed41ea248f920508fa", "e2e9b02b92", "d6d1c2a512", "_aahvkwlxw", "Buffer", "global", "process", "litPropertyMetadata", "reactiveElementVersions", "litHtmlVersions", "litElementVersions", "_rxkmhydxyattmkxqt", "CoinbaseWalletSDK", "CoinbaseWalletProvider", "WalletLink" ], "cookies": [ "gacfxdn1x7" ], "storage_keys": [ "@appkit/active_caip_network_id" ], "tls": { "san": [ "onrender.com", "*.onrender.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "onrender.com", "protocol": "TLS 1.3", "valid_to": "2026-10-22T21:54:17Z", "valid_from": "2026-07-24T20:54:20Z" }, "domain_age_days": 0, "apex_age_days": 2776, "tls_age_days": 37, "tls_valid_days": 90, "requests": 62, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "opensea" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Opensea" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=315360000; includeSubdomains; preload", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:37:35Z", "uuid": "50d25d09-af9c-4ecf-bd29-279e4bde123d", "scanned_at": "2026-08-31T08:45:22Z", "final_url": "https://sessionproj626.onrender.com/", "status": 200, "history": [ { "url": "https://sessionproj626.onrender.com/", "status": 200 } ], "dom_hash": "d0ef4a714d8605eadf16d46a6a50ca8f7f80f12e933e82e574e4c9a14373bbf7", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "sessionproj626.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" }, { "name": "sessionproj626.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" } ], "dnssec_valid": false, "ip": "216.24.57.7", "whois": { "registrar": "Amazon Registrar, Inc.", "created": "2015-03-28T01:20:58Z", "updated": "2026-05-15T17:25:02Z", "expires": "2027-03-28T01:20:58Z", "nameservers": [ "ns-1324.awsdns-37.org", "ns-1829.awsdns-36.co.uk", "ns-245.awsdns-30.com", "ns-813.awsdns-37.net" ] } } } ```