web[.]polymarket-apprestore[.]com

web.polymarket-apprestore.com is a subdomain of polymarket-apprestore.com. PhishDestroy first observed the hostname on Dec 25, 2025. Stored content metadata identifies Coinbase as the apparent target. The captured page title is “Polymarket | The World's Largest Prediction Market”. Page analysis recorded additional brand references to Coinbase wallet, Ledger, Netflix, and Scroll. Stored page analysis classifies the content as brand impersonation. Current evidence score: 95/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, URLQuery, and URLScan. VirusTotal recorded 10 detections among 93 engines: ADMINUSLabs, BitDefender, CRDF, CyRadar, Fortinet, G-Data, Google Safebrowsing, SOCRadar, Sophos, VIPRE on Jun 21, 2026 at 10:15 UTC. URLQuery recorded 100 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Polymarket and assigned phishing as its category on Jul 29, 2026 at 03:29 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:28 UTC; content was unavailable. Registration records for the registrable domain polymarket-apprestore.com list MAT BAO CORPORATION as the registrar and Dec 23, 2025 as the creation date. Registration preceded first observation by 1 day. At collection time, the hostname resolved to 111.90.156.186 on AS45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY). The recorded endpoint location is Sofia, BG. The stored server header is LiteSpeed. DOM analysis on Apr 23, 2026 at 07:23 UTC returned 30/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 3 positive source findings support the current Coinbase-themed brand impersonation classification.