# PhishDestroy domain threat record: parimatch-ua.cz Content language: English Canonical HTML report: https://phishdestroy.io/domain/parimatch-ua.cz/ Machine-readable companion: https://phishdestroy.io/domain/parimatch-ua.cz/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-07 13:47:53 UTC - Last availability or vendor check: 2026-10-22 10:30:36 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 12/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: google ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: REG-OPENPROVIDER - Registrar country in stored WHOIS data: 3032 AC - Last stored HTTP status: 403 - Registration date (registry RDAP, parimatch-ua.cz): 2023-10-01 15:13:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a07c1f-ab9f-7729-987e-ebf3d0af7729/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/parimatch-ua.cz - Certificate Transparency search: https://crt.sh/?q=%25.parimatch-ua.cz - Web Archive lookup: https://web.archive.org/web/*/https://parimatch-ua.cz/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview parimatch-ua.cz poses as Parimatch, the sports betting and casino brand. The "ua" in the name points the lure at Ukrainian players looking for a local version of the service. PhishDestroy first flagged the domain on 2026-09-07, and it was still online on 2026-10-19, with its content sitting behind a Cloudflare protection layer. How the scam works Betting-brand impersonation works by copying the look of the real operator closely enough that players sign in or fund an account without a second thought. Anything typed into a fake login or deposit form goes straight to the operators. That includes account credentials, card numbers and personal details, and any money sent as a deposit is lost. The page currently shows the title "Attention Required! | Cloudflare", a browser check screen, while our classification is impersonation phishing. Evidence On VirusTotal, 12 of 89 engines flagged the domain as of 2026-09-18. The flagging vendors include alphaMountain.ai, BitDefender, Chong Lua Dao, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and Lionic. Several independent vendors reached the same verdict, which supports the classification even though most engines have not caught up. The domain also appears in 4 AlienVault OTX threat pulses, and PhishDestroy lists it on its blocklist. Infrastructure The domain was registered on 2023-10-01 through Openprovider, nearly three years before PhishDestroy detected it. A long-held domain avoids the suspicion that brand-new registrations attract. Traffic is served through Cloudflare, Inc., on an address geolocated to Canada, so the real origin server is hidden behind the proxy. The certificate comes from Google Trust Services, the standard issuer for Cloudflare-fronted sites, so it says nothing about the site's legitimacy. What to do If you signed in on this site, change your Parimatch password right away, along with any account that shares it, and turn on two-factor authentication. If you entered card details or made a deposit, contact your bank to block the card and dispute the charges, then watch your statements. Reach Parimatch only through its official app or a bookmarked address, never through links in ads or messages. Defenders should block parimatch-ua.cz at DNS and proxy level and watch for lookalike domains that pair the Parimatch name with country codes. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a07c1f-ab9f-7729-987e-ebf3d0af7729/ VirusTotal report: https://www.virustotal.com/gui/domain/parimatch-ua.cz Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=parimatch-ua.cz Archived copy: https://web.archive.org/web/20251216050321/https://parimatch-ua.cz/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:48:05 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a07c1f-ab9f-7729-987e-ebf3d0af7729.png Captured: 2026-09-07 13:47:53 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a07c1f-ab9f-7729-987e-ebf3d0af7729.png Captured: 2026-09-07 13:47:53 UTC Source report: https://urlscan.io/result/01a07c1f-ab9f-7729-987e-ebf3d0af7729/ - URLScan capture 2: https://urlscan.io/screenshots/019bfa98-ced8-728c-a782-c898ece556af.png Captured: 2026-09-07 13:47:09 UTC Source report: https://urlscan.io/result/01a07c1f-ab9f-7729-987e-ebf3d0af7729/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/38a42fc2-fad1-4e92-b0de-f4798f0b09b3.png Captured: 2026-09-07 13:50:18 UTC Source report: https://radar.cloudflare.com/scan/38a42fc2-fad1-4e92-b0de-f4798f0b09b3 SHA-256: 08acc8c83e83fa14a683e0451490643288c07befcfa5fd1e1d90f5ee08ccb700 - URLScan ยท 2026-09-07: https://screenshots.phishdestroy.io/us/01a07c24-4506-73d9-a87e-4464cfbae717.png Captured: 2026-09-07 13:52:34 UTC Source report: https://urlscan.io/result/01a07c24-4506-73d9-a87e-4464cfbae717/ SHA-256: 38eedd32009ac1217d406c5547b7fe0cc62d5dddac27bcee45726fbce8f8df2a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:29:11Z", "uuid": "01a07c1f-ab9f-7729-987e-ebf3d0af7729", "scanned_at": "2026-09-07T13:47:33Z", "final_url": "https://parimatch-cz.net/", "status": 200, "redirected": "off-domain", "redirects": [ { "to": "https://czechia.parimatch-ua.cz/", "from": "https://parimatch-ua.cz/", "status": 301 }, { "to": "https://parimatch-cz.net/", "from": "https://czechia.parimatch-ua.cz/", "status": 301 } ], "ip": "188.114.97.3", "domains": [ "images.dmca.com", "www.clarity.ms", "czechia.parimatch-ua.cz", "parimatch-ua.cz", "counter.yadro.ru" ], "ips": [ "185.111.111.157", "20.250.198.32", "188.114.97.3", "188.114.96.3" ], "asns": [ "212238", "8075", "13335" ], "countries": [ "DE", "CH" ], "link_domains": [ "chciodvykat.cz", "hazardni-hrani.cz", "drogy-info.cz", "trustpilot.com", "x.com", "instagram.com", "sananim.cz", "neocentrum.cz", "dmca.com", "gpwa.org" ], "social": [ "https://x.com/parimatchglobal", "https://instagram.com/parimatch" ], "doc_hash": "23a0453b1402c38bbc49bef9047886682ddb0d95075e92be09d038cc1d0479c2", "script_hashes": [ "0416e7172d75a1da4229113fa7769e579064719950c7e9a68133a01ca057cfef", "f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a" ], "globals": [ "MyAjax", "userSettings", "clarity", "RocketPreloadLinksConfig", "WPGlobus", "lazyLoadOptions", "lazyLoadThumb", "lazyLoadYoutubeIframe", "stickySettings", "umami", "__stickyHeaderHost", "__stickyFooterHost", "LazyLoad", "RocketLazyLoadScripts" ], "tls": { "san": [ "parimatch-cz.net", "*.parimatch-cz.net" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "parimatch-cz.net", "protocol": "QUIC", "valid_to": "2026-10-19T01:13:51Z", "valid_from": "2026-07-21T00:17:15Z" }, "domain_age_days": 562, "apex_age_days": 562, "tls_age_days": 48, "tls_valid_days": 90, "requests": 44, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 92, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "default-src 'self'; img-src * 'self' counter.yadro.ru youtube.com www.youtube.com youtube-nocookie.com www.youtube-nocookie.com *.clarity.ms demo.spribe.io aviator-demo.spribegaming.com *.cdn-d5.com d", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "geolocation=(), microphone=(), camera=(), payment=(), usb=()" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:58:16Z", "uuid": "38a42fc2-fad1-4e92-b0de-f4798f0b09b3", "scanned_at": "2026-09-07T13:50:18Z", "final_url": "https://parimatch-ua.cz/", "status": 403, "redirected": "https-only", "history": [ { "url": "http://parimatch-ua.cz/", "status": 307 }, { "url": "https://parimatch-ua.cz/", "status": 403 } ], "dom_hash": "e1e0ec04ba2dccd9143717ccf431a0c9d267fac4083951806a2652b5fb5fcf8d", "doc_hash": "6ce78156950431c1749c83e9cccfa94ccec3ee8f323b40331d70fcca65c292e9", "domain_risks": [ "Gambling", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "parimatch-ua.cz", "type": "A", "value": "104.21.85.114" }, { "name": "parimatch-ua.cz", "type": "A", "value": "172.67.205.146" }, { "name": "parimatch-ua.cz", "type": "AAAA", "value": "2606:4700:3035::6815:5572" }, { "name": "parimatch-ua.cz", "type": "AAAA", "value": "2606:4700:3031::ac43:cd92" } ], "dnssec_valid": false, "ip": "104.21.85.114", "whois": { "created": "2023-10-01T15:13:02Z", "updated": "2025-06-03T13:30:06Z", "expires": "2026-09-30T22:00:00Z", "nameservers": [ "joaquin.ns.cloudflare.com", "summer.ns.cloudflare.com" ] } } } ```