# zarama.xyz Prediction Markets Page Showing Bitcoin Up or Down Trading | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/zarama.xyz/ Machine-readable companion: https://phishdestroy.io/domain/zarama.xyz/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-11-01 02:19:25 UTC - Last availability or vendor check: 2026-11-01 02:19:25 UTC - Stored record updated: 2026-11-01 04:30:11 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Global Domain Group LLC - Last stored HTTP status: 302 - Registration date in stored WHOIS data: 2026-08-06 11:21:05 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a194e5-bcd0-739c-8abb-6a4c4f8af3fd/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/zarama.xyz - Certificate Transparency search: https://crt.sh/?q=%25.zarama.xyz - Web Archive lookup: https://web.archive.org/web/*/https://zarama.xyz/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy describes zarama.xyz as a prediction markets page where visitors pick Up or Down outcomes on Bitcoin price movement. The captured zarama.xyz page presents a prediction markets interface headed "Prediction markets" with 7624 active markets. Its featured market, "Bitcoin Up or Down," offers two selectable outcomes priced at 1.75x for UP and 2.13x for DOWN, alongside a live BTC/USD price chart, a price-to-beat marker, and a countdown timer. A feed of recent wallet-address trades and a "Live now" strip of other markets fill the remainder of the view. The stored VirusTotal domain result reports 3 detections out of 92 engines. SOCRadar reported "malicious"; Gridinsoft reported "suspicious". Package revision: 1dca44d44a42f058d7c5add7248d80bb8da9612ed4ea50c6863b4a447d81dfd9 Text generated (not scan time): 2026-11-01 03:53:02 Reviewed evidence snapshot: {"domain":"zarama.xyz","screenshot_available":true,"page_title":"Zarama — Forecast Exchange","original_meta_description":"Zarama — Put a price on what happens next: elections, matches, crypto moves and the stories in between. Positions close the moment the result is in.","initial_ai_description":"Insufficient page content for analysis","metadata_observed_on":"2026-11-01","initial_ai_description_kind":"previous AI opinion, not independent evidence","virustotal":{"detections":3,"engines":92,"malicious":1,"suspicious":2,"retrieved_date":"2026-11-01","analysis_date":"2026-10-30","flagging_vendors":["SOCRadar","Gridinsoft","Forcepoint ThreatSeeker"],"vendor_labels":{"SOCRadar":"malicious","Gridinsoft":"suspicious","Forcepoint ThreatSeeker":"suspicious"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-11-01T02:51:46Z","final_host":"zarama.xyz","captured_on":"2026-11-01"},"virustotal_public_summary":"The stored VirusTotal domain result reports 3 detections out of 92 engines. SOCRadar reported \"malicious\"; Gridinsoft reported \"suspicious\".","page_paragraph_target_characters":508} Source facts (timestamps as stored): {"record_id":1726180,"first_recorded_at":"2026-11-01 03:19:25","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":3,"denominator":92,"malicious":1,"suspicious":2,"vendors":{"SOCRadar":"malicious","Gridinsoft":"suspicious","Forcepoint ThreatSeeker":"suspicious"},"observed_at":"2026-10-30T07:59:22Z","checked_at":"2026-11-01 03:51:39","fetched_at":"2026-11-01T02:51:37Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":3,"denominator":92,"malicious":null,"suspicious":null,"vendors":["Forcepoint ThreatSeeker","Gridinsoft","SOCRadar"],"observed_at":"2026-10-30 07:59:22","checked_at":"2026-11-01 03:51:39","fetched_at":"2026-11-01 02:51:39","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-01 03:51:40"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-01 04:30:49"},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-11-01 03:19:25"}} ## Stored page captures - Primary capture: https://i.ibb.co/WNxkN2Lr/91e3a75dfe34.png Captured: 2026-11-01 02:19:25 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a194e5-bcd0-739c-8abb-6a4c4f8af3fd.png Captured: 2026-11-01 02:19:25 UTC Source report: https://urlscan.io/result/01a194e5-bcd0-739c-8abb-6a4c4f8af3fd/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/216c3852-8c40-42c8-8a56-e961a0ddb125.png Captured: 2026-11-01 02:51:46 UTC Source report: https://radar.cloudflare.com/scan/216c3852-8c40-42c8-8a56-e961a0ddb125 SHA-256: 0880beb6d3687ac02709510c5a39489cdd9f3f2d345e6587c5f1844b5df0f3c0 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-01T02:35:39Z", "uuid": "01a194e5-bcd0-739c-8abb-6a4c4f8af3fd", "scanned_at": "2026-11-01T02:17:37Z", "final_url": "https://zarama.xyz/markets", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://zarama.xyz/", "from": "http://zarama.xyz/", "status": 307 }, { "to": "https://zarama.xyz/markets", "from": "https://zarama.xyz/", "status": 302 } ], "ip": "104.21.92.158", "domains": [ "api.exchange.coinbase.com", "ws-feed.exchange.coinbase.com", "www.clarity.ms", "static.cloudflareinsights.com", "telegram.org", "fonts.bunny.net" ], "ips": [ "172.64.151.78", "4.153.187.221", "104.16.79.73", "149.154.167.99", "152.233.50.2", "104.21.92.158" ], "asns": [ "13335", "8075", "62041", "212238" ], "countries": [ "US", "NL" ], "link_domains": [ "www.tradingview.com" ], "doc_hash": "1e2d71a0aaa865db3f4cdeb31a4784f996673435076366909b4d9a892faa8b1c", "script_hashes": [ "4feb1cbeb47e55f4b989363a56798c99f307827fc4c20e5f97d093188ad78219", "731989dbe1b806f3dbd645c100dfae5efb29d53a7c303330941d10e8b594c94f", "024c5ba40e6bf896b27dc5b744cd1bbdfad80d3bcd39a244e643ab558bac2bbd", "ceb4e11fb57afdb4f8cf94650a4f06e9eec238fb9091eefb10b3a14a4dc7bb27", "7a4981d645f3b029f9a0150018377c041aa382a6f2fd2a8e24a090f56caf4753", "c77884b6a99c3263fddddc17137524e0ece00bf23d9dbde9688d4becdfa0abae", "804c7eb15c513960ca58e0c00af8a22e5a939beeb2341dee08b38381b049dfd3", "6d8c138ff0d0935a8aaa4a20f918ce6412339d77455d1fee678a86c2d5f54a73", "25506e7c8389ecd7f8e0600a23cab2b8761fe611a19cc5350e6a6f79d1b43aff", "69b1c469f5ab07baa69fc8d20f62289b1f0d485333c38c29b20cfad6861730df" ], "globals": [ "__pmDefaultTheme", "__pmVariant", "__pmAccent", "__VUE_INSTANCE_SETTERS__", "__VUE_SSR_SETTERS__", "Pusher", "__INTLIFY_PROD_DEVTOOLS__", "__INTLIFY_JIT_COMPILATION__", "__INTLIFY_DROP_MESSAGE_COMPILER__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "Echo", "__VUE__", "__cfBeacon", "clarity", "Telegram", "TelegramGameProxy_receiveEvent", "TelegramGameProxy" ], "cookies": [ "_su", "XSRF-TOKEN", "atlascorppoly-session", "__cf_bm" ], "storage_keys": [ "__telegram__initParams", "pusherTransportTLS" ], "tls": { "san": [ "zarama.xyz", "*.zarama.xyz" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "zarama.xyz", "protocol": "QUIC", "valid_to": "2027-01-02T18:57:09Z", "valid_from": "2026-10-04T17:57:16Z" }, "domain_age_days": 86, "apex_age_days": 86, "tls_age_days": 27, "tls_valid_days": 90, "requests": 235, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 94, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "content-security-policy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'nonce-abe88b3c325e89fa2acda2acd76b844b' 'unsafe-inline' 'unsafe-eval' https:; sty", "x-frame-options": "SAMEORIGIN\nSAMEORIGIN", "x-content-type-options": "nosniff\nnosniff", "referrer-policy": "strict-origin-when-cross-origin\nstrict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=()\ncamera=(), microphone=(), geolocation=(), payment=()" } }, "cf": { "v": 1, "fetched_at": "2026-11-01T02:52:19Z", "uuid": "216c3852-8c40-42c8-8a56-e961a0ddb125", "scanned_at": "2026-11-01T02:51:46Z", "final_url": "https://zarama.xyz/markets", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://zarama.xyz/", "status": 302 }, { "url": "https://zarama.xyz/markets", "status": 200 } ], "dom_hash": "079ff1f776cf1b3dbb17946462335f1cbcb7f4c28dee5cef6676f37969287636", "doc_hash": "f1b2a9b4e1847a56cc0b7a80b05be35343235d0db552331414423bb575529bf3", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "zarama.xyz", "type": "A", "value": "172.67.195.107" }, { "name": "zarama.xyz", "type": "A", "value": "104.21.92.158" }, { "name": "zarama.xyz", "type": "AAAA", "value": "2606:4700:3032::6815:5c9e" }, { "name": "zarama.xyz", "type": "AAAA", "value": "2606:4700:3036::ac43:c36b" } ], "dnssec_valid": false, "ip": "127.0.1.10", "whois": { "registrar": "Global Domain Group LLC", "created": "2026-08-06T13:21:05Z", "updated": "2026-08-11T13:22:23Z", "expires": "2027-08-06T23:59:59Z", "nameservers": [ "mckenzie.ns.cloudflare.com", "rodrigo.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-01T02:51:37Z", "analysis_at": "2026-10-30T07:59:22Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 2, "undetected": 34 }, "detections": { "SOCRadar": "malicious", "Gridinsoft": "suspicious", "Forcepoint ThreatSeeker": "suspicious" }, "reputation": 0, "registrar": "Global Domain Group LLC", "created": "2026-08-06T13:21:05Z", "expires": "2027-08-06T23:59:59Z", "updated": "2026-08-11T13:22:23Z", "first_seen": "2026-08-06T14:18:29Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::ac43:c36b" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::6815:5c9e" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "mckenzie.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.92.158" }, { "ttl": 21600, "type": "NS", "value": "mckenzie.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.195.107" }, { "ttl": 21600, "type": "NS", "value": "rodrigo.ns.cloudflare.com" } ], "dns_at": "2026-10-30T08:00:11Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "zarama.xyz", "*.zarama.xyz" ], "issuer": "Google Trust Services / WE1", "serial": "be85ecac8637f428132e5d8feec10948", "sha256": "d2278f09ce0f18a7961d2293667926b3a4ac68989d99bed5702d7c171fc0bd8a", "subject": "zarama.xyz", "valid_to": "2027-01-02T18:57:09Z", "valid_from": "2026-10-04T17:57:16Z" }, "whois": { "registrar": "Global Domain Group LLC", "registrar_iana_id": "3956", "registrar_url": "https://www.globaldomaingroup.com", "created": "2026-08-06T13:21:05Z", "updated": "2026-08-11T13:22:23Z", "expires": "2027-08-06T23:59:59Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "mckenzie.ns.cloudflare.com", "rodrigo.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-11-01T02:52:41Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "zarama.xyz" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://zarama.xyz/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 5000 }, "social_tags": { "ogUrl": "https://zarama.xyz/markets", "title": "Zarama — Forecast Exchange", "ogType": "website", "ogImage": "https://zarama.xyz/preview_poly.png", "ogTitle": "Zarama — Forecast Exchange", "ogSiteName": "Zarama — Forecast Exchange", "description": "Zarama — Put a price on what happens next: elections, matches, crypto moves and the stories in between. Positions close the moment the result is in.", "twitterCard": "summary_large_image", "canonicalUrl": "https://zarama.xyz/markets", "ogDescription": "Zarama — Put a price on what happens next: elections, matches, crypto moves and the stories in between. Positions close the moment the result is in." }, "trackers": { "requests": 182, "trackers": [ { "name": "Bunny CDN", "company": "BunnyWay", "country": "SI", "category": "Hosting", "requests": 1 }, { "name": "Microsoft Clarity", "company": "Microsoft", "country": "US", "category": "Site Analytics", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://telegram.org/js/telegram-web-app.js" ], "upgrade_insecure": true, "third_party_scripts": 1 }, "status": { "up": true, "code": 302, "timings": { "dns": 32, "tls": 67, "wait": 111, "connect": 11, "download": 0 }, "response_ms": 221 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 430496, "co2_grams": 0.0157, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "172.64.35.78", "host": "rodrigo.ns.cloudflare.com" }, { "ip": "162.159.38.253", "host": "mckenzie.ns.cloudflare.com" } ], "zone": "zarama.xyz" }, "cookies": { "cookies": [ { "name": "_su", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "XSRF-TOKEN", "secure": true, "same_site": "Lax" }, { "name": "atlascorppoly-session", "secure": true, "http_only": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "zarama.xyz" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "rodrigo.ns.cloudflare.com", "mckenzie.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"mckenzie.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416625950, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN, SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin, strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), camera=(), microphone=(), g", "xContentTypeOptions": "nosniff, nosniff", "contentSecurityPolicy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'n", "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://zarama.xyz", "/markets" ], "count": 1 }, "whois": { "registrar": "Global Domain Group LLC", "created": "2026-08-06T13:21:05Z", "updated": "2026-08-11T13:22:23Z", "expires": "2027-08-06T23:59:59Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "mckenzie.ns.cloudflare.com", "rodrigo.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "content-security-policy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'nonce-a550178cdec50d5cf400151815d28415' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https://fonts.bunny.net; img-src 'self' data: blob: https:; font-src '", "x-frame-options": "SAMEORIGIN, SAMEORIGIN", "x-content-type-options": "nosniff, nosniff", "referrer-policy": "strict-origin-when-cross-origin, strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), camera=(), microphone=(), geolocation=(), payment=()" } } } } ```