# PhishDestroy domain threat record: testtron.onrender.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/testtron.onrender.com/ Machine-readable companion: https://phishdestroy.io/domain/testtron.onrender.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 07:32:21 UTC - Last availability or vendor check: 2026-10-22 10:11:24 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 216.24.57.7 - Registrar in stored WHOIS data: Render Services Inc. - Last stored HTTP status: 301 - Registration date (registry RDAP, onrender.com): 2015-03-28 01:20:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a056ba-ec4c-743d-a470-f8df0fff80e7/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/testtron.onrender.com - Certificate Transparency search: https://crt.sh/?q=%25.testtron.onrender.com - Web Archive lookup: https://web.archive.org/web/*/https://testtron.onrender.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview testtron.onrender.com is an impersonation phishing page that calls itself "Tether Web3 | USDT Verifier". It borrows Tether's name to target people holding USDT, especially anyone worried about whether their stablecoins are "clean" or flagged. PhishDestroy first detected it on 2026-08-31. On 2026-10-19 it was still online and serving a redirect. How the scam works Fake "USDT verifiers" offer to scan your wallet and confirm that your tokens are legitimate, unfrozen or eligible for something. The check is the bait. To run the "verification", the page asks you to connect a wallet and approve a transaction or token permission, or to type in a recovery phrase. Tether runs no service like this. A signed approval lets the operator move your USDT and other tokens whenever they like, and a recovery phrase gives them the whole wallet. Evidence When checked on 2026-10-15, 4 of 92 VirusTotal engines flagged the address: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet and Gridinsoft. That is a low count, so many browsers and security products may still let the page load without a warning. ScamSniffer, a blocklist focused on crypto wallet threats, lists the site independently alongside PhishDestroy. Its listing backs up the classification from a source that specializes in Web3 fraud. Infrastructure The page runs as a free app subdomain on Render's cloud platform, hosted at 216.24.57.7 in the US. The 2015-03-28 registration date and the registrar, Render Services Inc., belong to Render's shared onrender.com domain, not to the operator. Anyone can launch a page like this in minutes, and the domain's age says nothing about trustworthiness. The Google Trust Services certificate is issued automatically to Render apps, so the padlock in the browser proves nothing about who runs the site. What to do If you connected a wallet and signed anything on this page, open a token-approval manager for that chain right away and revoke any permissions you don't recognize. Then move your remaining funds to a fresh wallet. If you entered a recovery phrase, treat the wallet as compromised and move all assets to a new wallet created with a new phrase. Do not reuse the old wallet. Never pay anyone who later offers to "recover" or "unfreeze" your USDT. Defenders should block the full subdomain and report it to Render's abuse team so the app can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a056ba-ec4c-743d-a470-f8df0fff80e7/ VirusTotal report: https://www.virustotal.com/gui/domain/testtron.onrender.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=testtron.onrender.com Archived copy: https://web.archive.org/web/20260831073339/https://testtron.onrender.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:53:55 UTC ## Stored page captures - Primary capture: https://i.ibb.co/cXcTVc5k/ca3de4e759bc.png Captured: 2026-08-31 07:32:21 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a056ba-ec4c-743d-a470-f8df0fff80e7.png Captured: 2026-08-31 07:32:21 UTC Source report: https://urlscan.io/result/01a056ba-ec4c-743d-a470-f8df0fff80e7/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:26:51Z", "uuid": "01a056ba-ec4c-743d-a470-f8df0fff80e7", "scanned_at": "2026-08-31T07:31:33Z", "final_url": "https://testtron.onrender.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://testtron.onrender.com/", "from": "http://testtron.onrender.com/", "status": 307 } ], "ip": "216.24.57.15", "ptr": "ip-216-24-57-15.ingress.render.com", "domains": [ "cdn.jsdelivr.net" ], "ips": [ "2606:4700::6811:cf05", "216.24.57.15" ], "asns": [ "13335", "397273" ], "countries": [ "US" ], "doc_hash": "8a85b87abe81d158ec9a21d158126fe801b9415dd3911c9f5ecc13a3b5c18baf", "script_hashes": [ "bedf28b2b80e9eac62d807e3d1ca1eb0f55ed858455b970a330bcfd7ee2aec1e", "69e373bff8b43d95284168eb5a2d5062f727c2179d5fb2b91f23c10901666c3f" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "_ethers", "ethers", "CONFIG" ], "tls": { "san": [ "onrender.com", "*.onrender.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "onrender.com", "protocol": "TLS 1.3", "valid_to": "2026-10-22T21:54:17Z", "valid_from": "2026-07-24T20:54:20Z" }, "domain_age_days": 1, "apex_age_days": 2776, "tls_age_days": 37, "tls_valid_days": 90, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=315360000; includeSubdomains; preload", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:37:43Z", "uuid": "9a812331-9ed4-4ba2-a5c6-3528995269af", "scanned_at": "2026-08-31T07:41:47Z", "final_url": "https://testtron.onrender.com/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://testtron.onrender.com/", "status": 307 }, { "url": "https://testtron.onrender.com/", "status": 200 } ], "dom_hash": "f99c951fc039ee8aa2a9b2f911068092402ae5c54f88eff32194cdd8d3affe31", "doc_hash": "8a85b87abe81d158ec9a21d158126fe801b9415dd3911c9f5ecc13a3b5c18baf", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "testtron.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" }, { "name": "testtron.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" } ], "dnssec_valid": false, "ip": "216.24.57.7", "whois": { "registrar": "Amazon Registrar, Inc.", "created": "2015-03-28T01:20:58Z", "updated": "2026-05-15T17:25:02Z", "expires": "2027-03-28T01:20:58Z", "nameservers": [ "ns-1324.awsdns-37.org", "ns-1829.awsdns-36.co.uk", "ns-245.awsdns-30.com", "ns-813.awsdns-37.net" ] } } } ```