# PhishDestroy domain threat record: sessions.baseapp.qa246.ubware.it Content language: English Canonical HTML report: https://phishdestroy.io/domain/sessions.baseapp.qa246.ubware.it/ Machine-readable companion: https://phishdestroy.io/domain/sessions.baseapp.qa246.ubware.it/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-01 19:48:45 UTC - Last availability or vendor check: 2026-10-22 10:23:33 UTC - Stored record updated: 2026-10-22 15:44:47 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: linea ## Stored infrastructure - Observed IP address: 79.6.28.60 - Registrar in stored WHOIS data: Register S.p.a. - Registrar country in stored WHOIS data: Unknown - Registration date in stored WHOIS data: 2015-04-15 22:43:17 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05e83-1bb6-72d4-bfa6-dfb63c677ba5/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/sessions.baseapp.qa246.ubware.it - Certificate Transparency search: https://crt.sh/?q=%25.sessions.baseapp.qa246.ubware.it - Web Archive lookup: https://web.archive.org/web/*/https://sessions.baseapp.qa246.ubware.it/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview sessions.baseapp.qa246.ubware.it is an impersonation phishing page. It is buried several levels deep under an Italian domain and uses "baseapp" and "sessions" in its hostname to pass as a Base App sign-in or session page for crypto wallet users. PhishDestroy first flagged it on 2026-09-01. As of 2026-10-19 the server still answers, but the phishing content is no longer active. How the scam works The page title reads only "Redirecting...", a placeholder rather than branded content. We classified the host as impersonation. Pages like this usually act as a relay, briefly showing a redirect notice before sending visitors to a lookalike Base App screen. That screen asks them to reconnect a wallet, restore a session, or enter a recovery phrase. Whatever the victim approves or types goes to the operator, who can then take wallet access or sign transactions that empty the funds. Evidence VirusTotal detection is thin: 4 of 92 engines flagged the host as of 2026-10-15. Those engines were alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and SOCRadar. Stronger support comes from the crypto ecosystem itself. Besides PhishDestroy, the host appears on the MetaMask and SEAL blocklists, both curated specifically for wallet-targeting phishing. That means wallet extensions and security tooling that use those lists should already warn visitors. Infrastructure The parent domain, ubware.it, was registered on 2015-04-16 through Register S.p.a. That is more than eleven years before this hostname surfaced, so a long-standing domain is lending its age and reputation to a throwaway subdomain. The "qa246" label suggests a test or staging environment that was reused or exposed. Hosting sits on the Telecom Italia S.p.A. network in Italy. The Let's Encrypt certificate only means the page loads with a padlock, which says nothing about whether it is legitimate. What to do If you only opened the page, close it and do not return through any link that led you there. If you connected a wallet or signed anything, revoke token approvals and permissions granted around that time using a reputable approval checker. Move remaining assets to a fresh wallet if you are unsure what you signed. If you typed a seed phrase, treat that wallet as compromised and transfer funds out immediately to a new wallet created from a new phrase. Defenders should block the full hostname and keep watching the parent domain for new subdomains using wallet brand names. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05e83-1bb6-72d4-bfa6-dfb63c677ba5/ VirusTotal report: https://www.virustotal.com/gui/domain/sessions.baseapp.qa246.ubware.it Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sessions.baseapp.qa246.ubware.it Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:52:07 UTC ## Stored page captures - Primary capture: https://i.ibb.co/N6DJwDLc/4f727b8259bf.png Captured: 2026-09-01 19:48:45 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05e83-1bb6-72d4-bfa6-dfb63c677ba5.png Captured: 2026-09-01 19:48:45 UTC Source report: https://urlscan.io/result/01a05e83-1bb6-72d4-bfa6-dfb63c677ba5/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:55:29Z", "uuid": "01a05e83-1bb6-72d4-bfa6-dfb63c677ba5", "scanned_at": "2026-09-01T19:47:33Z", "final_url": "https://www.trevigroupsrl.it/", "status": 200, "redirected": "off-domain", "redirects": [ { "to": "https://sessions.baseapp.qa246.ubware.it/", "from": "http://sessions.baseapp.qa246.ubware.it/", "status": 307 }, { "to": "https://www.trevigroupsrl.it/", "from": "https://sessions.baseapp.qa246.ubware.it/" } ], "ip": "213.158.93.66", "ptr": "213.158.93.66.static.teamblue-ops.net", "domains": [ "www.googletagmanager.com", "fonts.gstatic.com", "fonts.googleapis.com", "sessions.baseapp.qa246.ubware.it", "region1.google-analytics.com" ], "ips": [ "216.239.34.36", "142.251.14.94", "142.251.20.97", "142.251.20.95", "213.158.93.66", "79.6.28.60" ], "asns": [ "15169", "34762", "3269" ], "countries": [ "US", "IT" ], "link_domains": [ "cookiedatabase.org", "www.linkedin.com", "maps.app.goo.gl" ], "doc_hash": "8daae7280a919c14bcdb0ff086c52b5b628a9375a262017d470301ad23860aae", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "16780269e362021d705b44bc75b8f5bb3e44619427c64a972a8ac7f1fe3bb1fc", "8d84c3ee35885bafd76313a5a1eb4520caef469eb4d1315c0d1071bec2e192b1", "d949f1c3687aedadcedac85261865f29b17cd273997e7f6b2bfc53b2f9d4c4dd", "35f4f974f4b2bcd44da73963347f8952e341f83909e4498227d4e26b98f66f0d", "7bd739193c5075cca573d58fbceed30ba467e9213c6d240006b443dacd3edc12", "15b68344bed56bab72064899515af374832e2d2ea6fa6a996b7b847f4b78b300", "033be9ca5e81f1203a46be7eedfa5734305995cbcfdde191dc1549f0efd00c92", "71cabe422a9b55469b54b288fb4920c100b7d9cd39ebcc52df73e6041460e560" ], "globals": [ "gtag", "dataLayer", "_googlesitekitConsentCategoryMap", "_googlesitekitConsents", "jQuery", "React", "ReactDOM", "wp", "MwaiAPI", "mwaiScrollLockManager", "mwaiInitialize", "dtLocal", "dtShare", "dtGlobals", "updateScrollTop", "Modernizr", "_googlesitekit", "$jh", "_tpt", "SR7", "Layzr", "simple_tooltip", "the7Utils", "showLazyImg", "The7Scroll", "PhotoSwipe", "PhotoSwipeUI_Default", "jQueryBridget", "EvEmitter", "getSize", "matchesSelector", "fizzyUIUtils", "Outlayer", "Isotope", "Masonry", "ResizeSensor", "StickySidebar", "tabbable", "focusTrap", "the7ApplyWidgetImageRatio" ], "tls": { "san": [ "firewall.trevigroup.biz", "nextcloud.trevigroupsrl.it", "nextcloud.ubware.it" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "firewall.trevigroup.biz", "protocol": "TLS 1.2", "valid_to": "2026-10-03T01:39:13Z", "valid_from": "2026-07-05T01:39:14Z" }, "domain_age_days": 3306, "apex_age_days": 3306, "tls_age_days": 55, "tls_valid_days": 89, "requests": 107, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -72, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:36Z", "uuid": "8dc3ad78-5f65-4537-baa5-7ae4ea0f3407", "scanned_at": "2026-09-01T20:10:27Z", "final_url": "https://sessions.baseapp.qa246.ubware.it/", "status": 307, "redirected": "https-only", "history": [ { "url": "http://sessions.baseapp.qa246.ubware.it/", "status": 307 }, { "url": "https://sessions.baseapp.qa246.ubware.it/", "status": 307 } ], "dom_hash": "222edc6576ce4f900a55dd02c5523f77c5fa64ee8b4e540f3ff8452026c169a8", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "sessions.baseapp.qa246.ubware.it", "type": "A", "value": "79.6.28.60" } ], "dnssec_valid": false, "whois": { "registrar": "REGISTER-REG", "created": "2015-04-16T00:43:17Z", "updated": "2026-03-13T00:54:12Z", "expires": "2027-02-25T00:00:00Z", "nameservers": [ "ns1.register.it", "ns2.register.it" ] } } } ```