# PhishDestroy domain threat record: simat-de-la-valldigna.rrhh.opensea.com.es Content language: English Canonical HTML report: https://phishdestroy.io/domain/simat-de-la-valldigna.rrhh.opensea.com.es/ Machine-readable companion: https://phishdestroy.io/domain/simat-de-la-valldigna.rrhh.opensea.com.es/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-01 19:58:42 UTC - Last availability or vendor check: 2026-10-22 10:33:34 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 10/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: OpenSea ## Stored infrastructure - Observed IP address: 3.123.199.169 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 302 ## Evidence links - URLScan report: https://urlscan.io/result/01a05e8c-5e32-71fe-be2b-373109608f43/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/simat-de-la-valldigna.rrhh.opensea.com.es - Certificate Transparency search: https://crt.sh/?q=%25.simat-de-la-valldigna.rrhh.opensea.com.es - Web Archive lookup: https://web.archive.org/web/*/https://simat-de-la-valldigna.rrhh.opensea.com.es/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview This site is a fraudulent NFT platform that abuses the OpenSea brand and domain styling to deceive NFT collectors and crypto wallet users. PhishDestroy first identified it on 2026-09-01, and as of 2026-10-19 it remains live and reachable. The domain construction — embedding "opensea" inside a long subdomain chain ending in ".com.es" — is designed to look credible at a glance while bypassing simple brand-matching filters. The page title reads "Gestión Nóminas y Personal - AYUNTAMIENTO de SIMAT DE LA VALLDIGNA", which describes a Spanish municipal payroll portal rather than an NFT marketplace; this conflicts with the OpenSea NFT scam classification. How the scam works Fake OpenSea mint and marketplace scams typically present victims with a convincing replica of the genuine OpenSea interface, inviting them to connect their crypto wallet to mint an NFT, claim a drop, or complete a transaction. Once a wallet is connected, the site requests a signature or approval that grants the attacker permission to transfer tokens and NFTs out of the victim's wallet. The victim loses digital assets — NFTs and cryptocurrency — often without any further interaction required after that initial approval. The misleading page title may serve to confuse automated scanners or present a different face to certain visitors. Evidence VirusTotal flagged this domain with 10 detections out of 89 engines checked on 2026-09-15. Vendors confirming the threat include ChainPatrol, BitDefender, CRDF, ESET, Fortinet, G-Data, Seclookup, and SOCRadar — a broad cross-vendor consensus spanning consumer antivirus, enterprise threat feeds, and specialist blockchain-security services. The domain also appears on three independent blocklists: PhishDestroy, MetaMask, and SEAL, meaning MetaMask users receive an in-browser warning before interacting with it. Infrastructure No registrar record is available for this domain. The site is hosted on Amazon Web Services infrastructure in Germany, resolving to an IP within the Amazon.com network. TLS is provided by Let's Encrypt under the YR2 intermediate, which issues certificates automatically and at no cost, a common choice for short-lived fraud infrastructure. What to do If you visited this site but did not connect a wallet or enter any credentials, no immediate action is required beyond avoiding the domain. If you connected a wallet, immediately revoke all token and NFT approvals granted to any contract associated with this site using a trusted approval-management tool, then transfer remaining assets to a fresh wallet address. If you entered personal or financial credentials, change those passwords and alert your financial institution. Security teams and platform operators should add this domain to blocklists and alert users who may have encountered it. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05e8c-5e32-71fe-be2b-373109608f43/ VirusTotal report: https://www.virustotal.com/gui/domain/simat-de-la-valldigna.rrhh.opensea.com.es Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=simat-de-la-valldigna.rrhh.opensea.com.es Archived copy: https://web.archive.org/web/20260901201633/https://simat-de-la-valldigna.rrhh.opensea.com.es/OpenSEEP/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 08:49:46 UTC ## Stored page captures - Primary capture: https://i.ibb.co/JjBJZKjD/8e544396f094.png Captured: 2026-09-01 19:58:42 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05e8c-5e32-71fe-be2b-373109608f43.png Captured: 2026-09-01 19:58:42 UTC Source report: https://urlscan.io/result/01a05e8c-5e32-71fe-be2b-373109608f43/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/71403404-0b60-42bc-a60c-e0df55471d75.png Captured: 2026-09-01 20:40:15 UTC Source report: https://radar.cloudflare.com/scan/71403404-0b60-42bc-a60c-e0df55471d75 SHA-256: cbdd0c5dfc5f150371ce9e23a6b7a3d5ce04a15bd8a8f784ced09ddf2aaeac5d - URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05e82-8f5e-756a-ba57-82644b9fcd93.png Captured: 2026-09-01 19:46:56 UTC Source report: https://urlscan.io/result/01a05e82-8f5e-756a-ba57-82644b9fcd93/ SHA-256: d7b88141f35307d7a1f2d810da9c46e660063fd25218f41fb14783af17dd2c8e - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a06160-1fa9-733d-9f29-01b0bb6c2fb3.png Captured: 2026-09-02 09:08:11 UTC Source report: https://urlscan.io/result/01a06160-1fa9-733d-9f29-01b0bb6c2fb3/ SHA-256: d7b88141f35307d7a1f2d810da9c46e660063fd25218f41fb14783af17dd2c8e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:55:22Z", "uuid": "01a05e8c-5e32-71fe-be2b-373109608f43", "scanned_at": "2026-09-01T19:57:38Z", "final_url": "https://simat-de-la-valldigna.rrhh.opensea.com.es/OpenSEEP/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://simat-de-la-valldigna.rrhh.opensea.com.es/", "from": "http://simat-de-la-valldigna.rrhh.opensea.com.es/", "status": 307 }, { "to": "https://simat-de-la-valldigna.rrhh.opensea.com.es/OpenSEEP/", "from": "https://simat-de-la-valldigna.rrhh.opensea.com.es/", "status": 302 } ], "ip": "3.123.199.169", "ptr": "ec2-3-123-199-169.eu-central-1.compute.amazonaws.com", "ips": [ "3.123.199.169" ], "asns": [ "16509" ], "countries": [ "DE" ], "doc_hash": "e3dea149c0b8dbb9f12e365cbf45d86dc23543696062965b5a2ec867ef8c47ab", "cookies": [ "JSESSIONID" ], "tls": { "san": [ "simat-de-la-valldigna.rrhh.opensea.com.es" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "simat-de-la-valldigna.rrhh.opensea.com.es", "protocol": "TLS 1.2", "valid_to": "2026-11-25T22:01:47Z", "valid_from": "2026-08-27T22:01:48Z" }, "domain_age_days": 546, "apex_age_days": 1607, "tls_age_days": 4, "tls_valid_days": 89, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 89, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache/2.4.18 (Ubuntu)", "content-type": "text/html;charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:32Z", "uuid": "71403404-0b60-42bc-a60c-e0df55471d75", "scanned_at": "2026-09-01T20:40:15Z", "final_url": "https://simat-de-la-valldigna.rrhh.opensea.com.es/OpenSEEP/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://simat-de-la-valldigna.rrhh.opensea.com.es/", "status": 307 }, { "url": "https://simat-de-la-valldigna.rrhh.opensea.com.es/", "status": 302 }, { "url": "https://simat-de-la-valldigna.rrhh.opensea.com.es/OpenSEEP/", "status": 200 } ], "dom_hash": "a5e52142fd2f9a30976831f96ce8b571105dba071d3b01de0e681a9e2a883238", "doc_hash": "e3dea149c0b8dbb9f12e365cbf45d86dc23543696062965b5a2ec867ef8c47ab", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "simat-de-la-valldigna.rrhh.opensea.com.es", "type": "A", "value": "3.123.199.169" } ], "dnssec_valid": false, "ip": "3.123.199.169", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] } } } ```