# PhishDestroy threat dossier — polymarket-dashboards.web.app ================================================================ Fetched: 2026-07-22 01:53:10 UTC Canonical: https://phishdestroy.io/domain/polymarket-dashboards.web.app/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 12/91 security vendors flagged this domain Flagging vendors: ChainPatrol, alphaMountain.ai, BitDefender, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Kaspersky, Lionic, Netcraft, Sophos, Webroot Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 199.36.158.100 (US, Mountain View) ASN: AS54113 Fastly, Inc. Hosting org: Google LLC Registrar: Google Firebase Page title: Site Not Found HTTP response: 404 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WR4 Expires: 2026-08-18 Status: INVALID chain Fingerprint: 06cb0a7c412f539ce624bff0f5454f8a4a38c54b5ef8d6f8a7fc761b1b141ace Subject Alternative Names (related infrastructure — often same operator): - web.app ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 12:38:33 UTC (by PhishDestroy tracker) Last verified: 2026-07-22 00:20:28 UTC Neutralised: 2026-07-20 00:23:17 UTC Current status: taken down (registrar suspended or DNS dead) ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-19 23:21:53 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] polymarket-dashboards.web.app: Confirmed Phishing Site Analysis of the domain polymarket-dashboards.web.app shows that it is actively being used as a phishing infrastructure. The hostname resolves to the IP address 199.36.158.100, which is owned by Google LLC and located in the United States. The site is served over TLS using a certificate issued by Google Trust Services (CN=WR4). HTTP requests receive a 301 redirect and the resulting page title is “Site Not Found”, indicating that the original malicious landing page is no longer directly accessible. Registration details reveal that the domain is hosted on Google Firebase, a common platform for short‑lived malicious sites. Reputation data shows the domain appears on three security blocklists and is specifically listed by PhishDestroy, MetaMask, and SEAL. VirusTotal scans have returned 12 detections out of 91 vendors, reinforcing the malicious classification. The threat is labeled as generic phishing with a high risk rating and remains active as of the report date. While the current page returns a generic “Site Not Found” title, the historical presence on blocklists and the TLS certificate tied to Google infrastructure suggest deliberate abuse of a trusted hosting environment. Defenders should block or sinkhole the domain, monitor outbound DNS queries for 199.36.158.100, and update email and web filters to reject any URLs containing polymarket-dashboards.web.app. Further investigation is needed to determine the exact phishing payloads previously delivered, as the present content does not reveal the original lure. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 06cb0a7c412f539ce624bff0f5454f8a4a38c54b5ef8d6f8a7fc761b1b141ace ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/polymarket-dashboards.web.app/ JSON API: https://api.destroy.tools/v1/check?domain=polymarket-dashboards.web.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,720 domains (57,297 alive under monitoring, 128,779 confirmed takedowns/dead). Site: https://phishdestroy.io