# PhishDestroy threat dossier — bet365--canada.ca.chronoboost-en.com ================================================================ Fetched: 2026-07-21 10:19:50 UTC Canonical: https://phishdestroy.io/domain/bet365--canada.ca.chronoboost-en.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 95/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Bet365 ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 80.82.77.215 (NL, Amsterdam) ASN: AS202425 IP Volume inc Hosting org: IP Volume inc Registrar: Register SPA Nameservers: ["ns1.hostperfy.xyz", "ns2.hostperfy.xyz"] Page title: Bet365 Canada: Best Sports Betting and Casino Games for Canadians HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-10-08 Status: INVALID chain Fingerprint: ee0207a0028c82b1b3b52427060780b49827ff79b071fd1d5e4c34c9a5cba0a1 Subject Alternative Names (related infrastructure — often same operator): - autoconfig.bet365--canada.ca - autoconfig.en-en-polymarket.com - autodiscover.bet365--canada.ca - autodiscover.en-en-polymarket.com - bet365--canada.ca - cpanel.bet365--canada.ca - cpanel.en-en-polymarket.com - cpcalendars.bet365--canada.ca - cpcalendars.en-en-polymarket.com - cpcontacts.bet365--canada.ca - cpcontacts.en-en-polymarket.com - en-en-polymarket.com - en-en-polymarket.com.chronoboost-en.com - mail.bet365--canada.ca - mail.en-en-polymarket.com ... +8 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 13:29:33 UTC (by PhishDestroy tracker) Last verified: 2026-07-21 08:20:22 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-19 13:49:40 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] bet365--canada.ca.chronoboost-en.com: Phishing Site Analysis of bet365--canada.ca.chronoboost-en.com shows an HTTP 200 response, indicating the server is actively serving web content. The domain appears on a single security blocklist and is currently listed as blocked by PhishDestroy, confirming that reputable anti‑phishing feeds consider it malicious. Although the site has been scanned by 95 VirusTotal engines with no detections reported, the absence of flags does not constitute evidence of safety; many phishing infrastructures evade static detection. The threat classification supplied is generic phishing, but no additional artifacts such as page titles, brand references, or phishing kit identifiers have been publicly disclosed, leaving the exact content and lure mechanisms unknown. Defenders should treat the domain as hostile: add it to DNS and proxy blocklists, enforce URL filtering policies that deny outbound connections, and monitor for any internal DNS queries or HTTP requests to the host. Continuous re‑scanning on platforms like VirusTotal is advised, as detection signatures may emerge later. Until further forensic analysis of the site’s payload is available, the precautionary stance is to deny all traffic to this domain and alert users about potential credential‑harvesting attempts linked to it. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: ee0207a0028c82b1b3b52427060780b49827ff79b071fd1d5e4c34c9a5cba0a1 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/bet365--canada.ca.chronoboost-en.com/ JSON API: https://api.destroy.tools/v1/check?domain=bet365--canada.ca.chronoboost-en.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,516 domains (57,551 alive under monitoring, 128,315 confirmed takedowns/dead). Site: https://phishdestroy.io