# PhishDestroy domain threat record: polymarket.atlascore-panel.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/polymarket.atlascore-panel.net/
Machine-readable companion: https://phishdestroy.io/domain/polymarket.atlascore-panel.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-21 16:38:36 UTC
- Last availability or vendor check: 2026-10-22 11:01:23 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Polymarket

## Stored infrastructure

- Observed IP address: 172.67.129.57
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 302
- Registration date (registry RDAP, atlascore-panel.net): 2026-05-27 10:20:28 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a15f53-6716-709a-a24e-49009fcab6cc/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/polymarket.atlascore-panel.net
- Certificate Transparency search: https://crt.sh/?q=%25.polymarket.atlascore-panel.net
- Web Archive lookup: https://web.archive.org/web/*/https://polymarket.atlascore-panel.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classified polymarket.atlascore-panel.net as an impersonation phishing page. The recorded page title was “AtlasCorpPoly — панель”. The domain was first seen by PhishDestroy on 2026-10-21. On that date the site returned an HTTP 302 redirect and the final destination returned HTTP 200 with a login page.

How the scam works
Impersonation phishing pages copy the look and language of legitimate services to lure users into entering credentials, seed phrases, or approving wallet connections. When victims submit such data, attackers can gain unauthorized access to accounts or drain funds. The classification reflects this generic risk, not observed theft on this particular site.

Evidence
VirusTotal scanned the domain on 2026-10-21 and reported two suspicious detections (Fortinet and alphaMountain.ai) out of 92 engines, with no malicious verdicts. Google Safe Browsing checked on 2026-10-21 and did not flag the site. urlscan.io captured the page on 2026-10-21; its engine analysis gave a malicious score of 94 but the overall verdict was non‑malicious. OTX had zero pulses on the same date. PhishDestroy’s internal blocklist contains the domain, while external blocklists returned zero hits on 2026-10-21.

Infrastructure
The domain resolved to Cloudflare‑provided IP addresses 172.67.129.57 and 104.21.1.126, which were associated with Cloudflare, Inc. in Canada at the time of observation. A Let’s Encrypt certificate for *.atlascore-panel.net was valid from 2026-09-22 to 2026-12-21. The domain was 51 days old and the apex domain 147 days old when recorded, and DNSSEC was not enabled.

What to do
Do not enter credentials or approve any wallet connections on this site; if you have already done so, change the affected passwords and review associated accounts for unauthorized activity. Defenders should block the exact hostname polymarket.atlascore-panel.net in web filters and monitor DNS queries for this name.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15f53-6716-709a-a24e-49009fcab6cc/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1afc3a96-73eb-49dc-9855-2b1dd95b7678
Stored capture screenshot: https://i.ibb.co/HwyJNvv/e64ab893cbba.png
Cloudflare Radar screenshot (2026-10-21T17:09:28Z): https://screenshots.phishdestroy.io/cf/1afc3a96-73eb-49dc-9855-2b1dd95b7678.png
URLScan screenshot (2026-10-21T16:34:54Z): https://screenshots.phishdestroy.io/us/01a15f50-bba9-77da-9ba5-5e2a48adbc9d.png
URLScan capture report: https://urlscan.io/result/01a15f50-bba9-77da-9ba5-5e2a48adbc9d/
VirusTotal report: https://www.virustotal.com/gui/domain/polymarket.atlascore-panel.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=polymarket.atlascore-panel.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 17:10:22 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/HwyJNvv/e64ab893cbba.png
  Captured: 2026-10-21 16:38:36 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a15f53-6716-709a-a24e-49009fcab6cc.png
  Captured: 2026-10-21 16:38:36 UTC
  Source report: https://urlscan.io/result/01a15f53-6716-709a-a24e-49009fcab6cc/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1afc3a96-73eb-49dc-9855-2b1dd95b7678.png
  Captured: 2026-10-21 17:09:28 UTC
  Source report: https://radar.cloudflare.com/scan/1afc3a96-73eb-49dc-9855-2b1dd95b7678
  SHA-256: 3df5de2bf06f16bb79c0daf6e5acab7e1ee3fb115e5fd5661dd1479062babf0d
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f50-bba9-77da-9ba5-5e2a48adbc9d.png
  Captured: 2026-10-21 16:34:54 UTC
  Source report: https://urlscan.io/result/01a15f50-bba9-77da-9ba5-5e2a48adbc9d/
  SHA-256: 351179cefc4eceba257ea28f17bc83c60b9640a1453b04555fe80170e182d90c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T17:09:45Z",
        "uuid": "01a15f53-6716-709a-a24e-49009fcab6cc",
        "scanned_at": "2026-10-21T16:37:49Z",
        "final_url": "https://polymarket.atlascore-panel.net/login",
        "status": 200,
        "ip": "104.21.1.126",
        "domains": [
            "fonts.bunny.net",
            "telegram.org"
        ],
        "ips": [
            "149.154.167.99",
            "88.198.57.50",
            "104.21.1.126"
        ],
        "asns": [
            "62041",
            "24940",
            "13335"
        ],
        "countries": [
            "NL",
            "DE"
        ],
        "link_domains": [
            "t.me"
        ],
        "social": [
            "https://t.me/AltasCorePolymarket_bot"
        ],
        "doc_hash": "072bc2a607e89c64df1db9b024fcce2e9bb4fc2c7d02e52e65eea6b5965b6ffa",
        "script_hashes": [
            "1c447d1e6e8b8cd224476051cd2997eb13141bab89d40bf989cbe773a84b7a06",
            "731989dbe1b806f3dbd645c100dfae5efb29d53a7c303330941d10e8b594c94f",
            "024c5ba40e6bf896b27dc5b744cd1bbdfad80d3bcd39a244e643ab558bac2bbd",
            "ceb4e11fb57afdb4f8cf94650a4f06e9eec238fb9091eefb10b3a14a4dc7bb27",
            "70fd0bfdd96db5dd06c6ca9504b32715646d89f5aa90149cc1c3abb707bd6f53",
            "71bb355c4cbf1c6345e66d6cc78faa5ed5a01a5542368b8f8818f68d2db5fe3c",
            "64b837a9aa16b52c3849ab1952e68d1e21bcb3b90c31e964eb1e68e926b57f71",
            "405a212a4d0d8a42008ce053d91a52fed8e21eae18066c77f6c00603cf24a720",
            "0240eb64ca0f5b97cb1269a2289c59ef2ad82741b8f696ac4b5365549460584a",
            "5ba21e39a5a1972ee710f48f6a1fa0133c25bc779ef3468253412cb0bfe4b537"
        ],
        "globals": [
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "Pusher",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "Echo",
            "__VUE__",
            "Telegram",
            "TelegramGameProxy_receiveEvent",
            "TelegramGameProxy"
        ],
        "cookies": [
            "XSRF-TOKEN",
            "atlascorppoly-session"
        ],
        "storage_keys": [
            "__telegram__initParams",
            "pusherTransportTLS"
        ],
        "tls": {
            "san": [
                "*.atlascore-panel.net",
                "atlascore-panel.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "atlascore-panel.net",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-21T13:11:09Z",
            "valid_from": "2026-09-22T13:11:10Z"
        },
        "domain_age_days": 51,
        "apex_age_days": 147,
        "tls_age_days": 29,
        "tls_valid_days": 89,
        "requests": 32,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "content-security-policy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'nonce-371f17643a04be1c00c86b0367524387' 'unsafe-inline' 'unsafe-eval' https:; sty",
            "x-frame-options": "SAMEORIGIN\nSAMEORIGIN",
            "x-content-type-options": "nosniff\nnosniff",
            "referrer-policy": "strict-origin-when-cross-origin\nstrict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=()\ncamera=(), microphone=(), geolocation=(), payment=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T17:09:47Z",
        "uuid": "1afc3a96-73eb-49dc-9855-2b1dd95b7678",
        "scanned_at": "2026-10-21T17:09:28Z",
        "final_url": "https://polymarket.atlascore-panel.net/login",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://polymarket.atlascore-panel.net/",
                "status": 302
            },
            {
                "url": "https://polymarket.atlascore-panel.net/panel",
                "status": 302
            },
            {
                "url": "https://polymarket.atlascore-panel.net/login",
                "status": 200
            }
        ],
        "dom_hash": "3723e4a8e40f949caa8e935be536d707f4fccbc429c0ff509fa6bb360f0fd01c",
        "doc_hash": "d7f957ed8cd04080813b30cc1f4d66208283441386da41d8b51914ca67cc94ff",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "polymarket.atlascore-panel.net",
                "type": "A",
                "value": "104.21.1.126"
            },
            {
                "name": "polymarket.atlascore-panel.net",
                "type": "A",
                "value": "172.67.129.57"
            },
            {
                "name": "polymarket.atlascore-panel.net",
                "type": "AAAA",
                "value": "2606:4700:3034::6815:17e"
            },
            {
                "name": "polymarket.atlascore-panel.net",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:8139"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.1.126",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-05-27T10:20:28Z",
            "updated": "2026-05-27T10:20:28Z",
            "expires": "2027-05-27T10:20:28Z",
            "nameservers": [
                "love.ns.cloudflare.com",
                "reese.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T17:09:21Z",
        "analysis_at": "2026-10-21T17:02:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 2,
            "undetected": 37
        },
        "detections": {
            "Fortinet": "spam",
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-05-27T10:20:28Z",
        "expires": "2027-05-27T10:20:28Z",
        "updated": "2026-05-27T10:20:28Z",
        "first_seen": "2026-07-05T17:49:44Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:17e"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.1.126"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:8139"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.129.57"
            }
        ],
        "dns_at": "2026-10-21T17:07:54Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.atlascore-panel.net",
                "atlascore-panel.net"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6a75d44370e755a1fc17729af150af04e46",
            "sha256": "c8dc0b5da13b1ba3f7ac4420c7158829381477be5499ccea9367af44fd2742e1",
            "subject": "atlascore-panel.net",
            "valid_to": "2026-12-21T13:11:09Z",
            "valid_from": "2026-09-22T13:11:10Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-05-27T10:20:28Z",
            "updated": "2026-05-27T10:20:28Z",
            "expires": "2027-05-27T10:20:28Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "love.ns.cloudflare.com",
                "reese.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T17:09:57Z",
        "caa_records": {
            "domain": "polymarket.atlascore-panel.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://polymarket.atlascore-panel.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5000
        },
        "social_tags": {
            "ogUrl": "https://polymarket.atlascore-panel.net/login",
            "title": "AtlasCorpPoly — панель",
            "ogType": "website",
            "ogImage": "https://polymarket.atlascore-panel.net/preview.png",
            "ogTitle": "AtlasCorpPoly — панель",
            "ogSiteName": "Seeded exchange host — Forecast Exchange",
            "themeColor": "#0b0b0b",
            "description": "Партнёрская панель: домены, трафик, мамонты, события и выплаты — всё в одном месте.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://polymarket.atlascore-panel.net/login",
            "ogDescription": "Партнёрская панель: домены, трафик, мамонты, события и выплаты — всё в одном месте."
        },
        "trackers": {
            "requests": 31,
            "trackers": [
                {
                    "name": "Bunny CDN",
                    "company": "BunnyWay",
                    "country": "SI",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://telegram.org/js/telegram-web-app.js"
            ],
            "upgrade_insecure": true,
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 302,
            "timings": {
                "dns": 4,
                "tls": 61,
                "wait": 132,
                "connect": 6,
                "download": 0
            },
            "response_ms": 203
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 11630,
            "co2_grams": 0.0004,
            "cleaner_than": 68
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.194.119",
                    "host": "love.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.117",
                    "host": "reese.ns.cloudflare.com"
                }
            ],
            "zone": "atlascore-panel.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "XSRF-TOKEN",
                    "secure": true,
                    "same_site": "Lax"
                },
                {
                    "name": "atlascorppoly-session",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3034::6815:17e",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "atlascore-panel.net"
        },
        "dns": {
            "A": [
                "104.21.1.126",
                "172.67.129.57"
            ],
            "AAAA": [
                "2606:4700:3034::6815:17e",
                "2606:4700:3030::ac43:8139"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN, SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin, strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), camera=(), microphone=(), g",
            "xContentTypeOptions": "nosniff, nosniff",
            "contentSecurityPolicy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'n",
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3034::6815:17e",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://polymarket.atlascore-panel.net",
                "https://polymarket.atlascore-panel.net/panel",
                "/login"
            ],
            "count": 2
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "docs.atlascore-panel.net"
            ]
        },
        "tech_stack": {
            "technologies": [
                "PHP",
                "Node.js",
                "Laravel",
                "Marko",
                "Inertia.js",
                "Bunny",
                "Laravel Echo",
                "Bunny Fonts",
                "Cloudflare",
                "PWA",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-05-27T10:20:28Z",
            "updated": "2026-05-27T10:20:28Z",
            "expires": "2027-05-27T10:20:28Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "love.ns.cloudflare.com",
                "reese.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "content-security-policy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'nonce-a911742ef33af26e377461889164f16b' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https://fonts.bunny.net; img-src 'self' data: blob: https:; font-src '",
                "x-frame-options": "SAMEORIGIN, SAMEORIGIN",
                "x-content-type-options": "nosniff, nosniff",
                "referrer-policy": "strict-origin-when-cross-origin, strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), camera=(), microphone=(), geolocation=(), payment=()"
            }
        }
    }
}
```