# polymarket.casino captured page showing Chrome download landing | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/polymarket.casino/ Machine-readable companion: https://phishdestroy.io/domain/polymarket.casino/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-11-01 02:17:36 UTC - Stored record updated: 2026-11-01 03:30:49 UTC - VirusTotal detections in the stored snapshot: 12/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): Polymarket ## Stored infrastructure - Observed IP address: 172.67.188.90 - Registrar in stored WHOIS data: NameSilo, LLC - Registration date in stored WHOIS data: 2026-08-07 14:54:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06af5-bd32-735a-b059-64df3084730f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/polymarket.casino - Certificate Transparency search: https://crt.sh/?q=%25.polymarket.casino - Web Archive lookup: https://web.archive.org/web/*/https://polymarket.casino/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy describes the captured polymarket.casino page, which displays a German Chrome download landing page. The captured polymarket.casino page presents a German-language Chrome browser landing page rather than a casino interface. Its main interaction is a prominent blue "Chrome herunterladen" (download Chrome) button beneath the headline "Ein Browser gemacht für dich," with a Google cookie notice bar across the bottom. The page's visible branding and download promise belong to the captured page itself. The stored VirusTotal domain result reports 12 detections out of 92 engines. CRDF reported "malicious"; G-Data reported "phishing". Package revision: eb9862a7abb8d731130ca1aee0af2ec107d657025e899ca150b45c75cbe646cf Text generated (not scan time): 2026-11-01 03:24:40 Reviewed evidence snapshot: {"domain":"polymarket.casino","screenshot_available":true,"virustotal":{"detections":12,"engines":92,"malicious":11,"suspicious":1,"retrieved_date":"2026-11-01","analysis_date":"2026-10-31","flagging_vendors":["CRDF","G-Data","Lionic","Sophos","Fortinet","SOCRadar","Seclookup","Gridinsoft","BitDefender","Chong Lua Dao","alphaMountain.ai","Forcepoint ThreatSeeker"],"vendor_labels":{"CRDF":"malicious","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Fortinet":"phishing","SOCRadar":"malicious","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-11-01T02:23:54Z"},"virustotal_public_summary":"The stored VirusTotal domain result reports 12 detections out of 92 engines. CRDF reported \"malicious\"; G-Data reported \"phishing\".","page_paragraph_target_characters":517} Source facts (timestamps as stored): {"record_id":1726183,"first_recorded_at":"2026-11-01 03:17:36","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":12,"denominator":92,"malicious":11,"suspicious":1,"vendors":{"CRDF":"malicious","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Fortinet":"phishing","SOCRadar":"malicious","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-31T06:11:40Z","checked_at":"2026-11-01 03:20:46","fetched_at":"2026-11-01T02:20:44Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":12,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","Chong Lua Dao","CRDF","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Lionic","Seclookup","SOCRadar","Sophos"],"observed_at":"2026-10-31 06:11:40","checked_at":"2026-11-01 03:20:46","fetched_at":"2026-11-01 02:20:46","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-01 03:20:52"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-01 04:30:49"},"availability":{"source":"stored HTTP observation","state":"unknown","observed_at":null}} ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a06af5-bd32-735a-b059-64df3084730f.png Captured: 2026-11-01 02:17:36 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a06af5-bd32-735a-b059-64df3084730f.png Source report: https://urlscan.io/result/01a06af5-bd32-735a-b059-64df3084730f/ - URLScan · 2026-08-10: https://screenshots.phishdestroy.io/us/019feae6-7f6e-715d-9e25-356f87750d82.png Captured: 2026-08-10 09:00:34 UTC Source report: https://urlscan.io/result/019feae6-7f6e-715d-9e25-356f87750d82/ SHA-256: 664cddf868f9cb0e7ce722f489a75e76dc5934897dd3ef23335affb0cbd2c543 - URLScan · 2026-11-01: https://screenshots.phishdestroy.io/us/01a194e9-b29e-774c-8dde-67f3bbb8f09f.png Captured: 2026-11-01 02:21:54 UTC Source report: https://urlscan.io/result/01a194e9-b29e-774c-8dde-67f3bbb8f09f/ SHA-256: b25a9fb82879d0603c8e03b799b29458e7f51c7e7a8a01ef48cc4a9852413b7b - URLScan · 2026-11-01: https://screenshots.phishdestroy.io/us/01a194ea-483c-765c-8aed-bc0aca7fa40b.png Captured: 2026-11-01 02:23:54 UTC Source report: https://urlscan.io/result/01a194ea-483c-765c-8aed-bc0aca7fa40b/ SHA-256: 3d88c3e990f664ce869bf00be43ec4f3c20a7aeafea220644aed3eb7719bc754 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d806d9fa-7f99-43f0-917d-9f6c8f57b743.png Captured: 2026-11-01 02:21:37 UTC Source report: https://radar.cloudflare.com/scan/d806d9fa-7f99-43f0-917d-9f6c8f57b743 SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-01T02:23:55Z", "uuid": "01a06af5-bd32-735a-b059-64df3084730f", "scanned_at": "2026-09-04T05:49:19Z", "final_url": "https://polymarket.casino/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://polymarket.casino/", "from": "http://polymarket.casino/", "status": 307 } ], "ip": "172.67.188.90", "domains": [ "fonts.gstatic.com", "gamma-api.polymarket.com", "fonts.googleapis.com", "api.coingecko.com", "static.cloudflareinsights.com" ], "ips": [ "142.251.163.94", "104.20.41.132", "104.18.34.205", "104.16.79.73", "64.233.180.95", "172.67.188.90" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "83ab6181e48fa36be65127c23e1dab58da04217a12a6537df3ffb5869f2471ab", "script_hashes": [ "332c702b1b2ea3a46b591f2b5440e84c61da93a9f947009a1441db65c741af30", "b1fdd634cdf51830156b8ba01f2b18d0dab804c548ec4744d88a8c93ab7da7d0", "7c137ac31e745cd2b1f5d15f8fc08e38910dffe51d1f246cc037dc63a7e818bd", "304c36c2823a356a1f1ad99dab105a158ce18750ac9c2a70e9a5b8ae25d14d25" ], "globals": [ "NcVars", "NC_VARS", "__ncOpenWallet", "NcTronModal", "webpackChunktron_drainer_script", "Buffer", "proto", "TronWebProto", "__ledgerLogsListen", "NcTron", "parseJsonField", "normalizeMarket", "getHighestOdd", "getOutcomeOdd", "formatOdd", "formatProbability", "updateMarketStats", "formatVolume", "formatDate", "marketIcon", "renderMarkets", "selectBet", "clearBet", "updatePayout", "escapeHtml", "showToast", "loadMarkets", "loadBitcoinPrice", "__cfBeacon", "POLYMARKET_API", "MARKET_FEEDS", "COINGECKO_API", "state", "elements" ], "tls": { "san": [ "polymarket.casino", "*.polymarket.casino" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "polymarket.casino", "protocol": "QUIC", "valid_to": "2026-11-25T15:02:06Z", "valid_from": "2026-08-27T14:03:29Z" }, "domain_age_days": 494, "apex_age_days": 494, "tls_age_days": 7, "tls_valid_days": 90, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-11-01T02:35:42Z", "uuid": "d806d9fa-7f99-43f0-917d-9f6c8f57b743", "scanned_at": "2026-11-01T02:21:37Z", "final_url": "https://polymarket.casino/", "status": 666, "history": [ { "url": "https://polymarket.casino/", "status": 666 } ], "dom_hash": "4a06835d00d712ec4c568b1f0ccf643fb099dec477093d1e3c35bff8ea5ca969", "doc_hash": "9c6c9174c53432930542cf9c6586d6da52cbd63c49b1172457d5b4e1771b4dbc", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "polymarket.casino", "type": "A", "value": "172.67.188.90" }, { "name": "polymarket.casino", "type": "A", "value": "104.21.48.235" } ], "dnssec_valid": false, "ip": "127.0.1.9" }, "vt": { "v": 1, "fetched_at": "2026-11-01T02:20:44Z", "analysis_at": "2026-10-31T06:11:40Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 11, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "phishing", "SOCRadar": "malicious", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)" }, "created": "2025-04-27T00:00:00Z", "updated": "2025-04-27T00:00:00Z", "first_seen": "2025-04-27T20:30:03Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "boyd.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.188.90" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=To_gqmItwKPWljgqUs1sPqgeyo3V50n-ZsC-Ki2xIc8" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "boyd.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "kayleigh.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.48.235" } ], "dns_at": "2026-10-31T06:30:49Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.polymarket.casino", "polymarket.casino" ], "issuer": "Let's Encrypt / YE2", "serial": "6c01b9b5b62ee08d14deb5413429b92c092", "sha256": "86e3c776d7dfe7722877e354c7094c8558872b29eee271f808810b2fd78dc9c4", "subject": "polymarket.casino", "valid_to": "2026-12-15T14:16:12Z", "valid_from": "2026-09-16T14:16:13Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-10-25T04:39:56Z", "registration": "2026-08-07T00:00:00Z", "registrar expiration": "2027-08-07T00:00:00Z", "last update of RDAP database": "2026-10-30T11:56:19Z" }, "registrar": "NameSilo, LLC", "registrar_iana_id": "1479" } }, "webcheck": { "v": 1, "fetched_at": "2026-11-01T02:24:23Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "polymarket.casino" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "172.64.33.75", "host": "boyd.ns.cloudflare.com" }, { "ip": "172.64.34.92", "host": "kayleigh.ns.cloudflare.com" } ], "zone": "polymarket.casino" }, "location": { "ip": "104.21.48.235", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "polymarket.casino" }, "dns": { "A": [ "172.67.188.90", "104.21.48.235" ], "NS": [ "boyd.ns.cloudflare.com", "kayleigh.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"boyd.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415904669, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=To_gqmItwKPWljgqUs1sPqgeyo3V50n-ZsC-Ki2xIc8" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "172.67.188.90", "family": 4 }, "subdomains": { "count": 2, "subdomains": [ "events.polymarket.casino", "www.polymarket.casino" ] } } } ```