VirusTotal
8 / 90 engine detections
打开报告pollymarket.global:冒充 MetaMask,PhishDestroy 于 2026-09-06 检测到。风险:关键(100/100)。注册商:PDR。状态:内容不可用。托管:CLOUDFLARENET - Cloudflare, Inc., US。PhishDestroy 已发送1 份滥用举报。VirusTotal:8/90 个引擎标记。已列入 Spamhaus DBL。请勿输入登录凭据,也不要连接钱包。
“Polymarket | The World's Largest Prediction Market™”
冒充 MetaMask: pollymarket.global — 内容不可用. 证据摘要: VirusTotal 8/90 (ChainPatrol, alphaMountain.ai, BitDefender, Forcepoint ThreatSeeker, G-Data); URLQuery 2…
为保留原始取证记录,下方的 PhishDestroy AI 详细分析仍使用英文。
8 / 90 engine detections
打开报告2 threat-system alerts
打开报告DBL_PHISH
4 community references
打开报告provider verdict: clean
打开报告80/100
打开报告无威胁标记
打开报告无恶意标记
打开报告结果反映各来源的采集时间。零检出不代表安全。OTX 引用为社区发布的内容。
PhishDestroy threat report
pollymarket.global is an impersonation phishing page posing as Polymarket, the crypto-based prediction market. The domain adds an extra "l" to the real brand name and uses a different extension, so it is easy to miss in a link or a hurried search. It targets Polymarket users and crypto traders. PhishDestroy first flagged it on 2026-09-06, and it has been offline since 2026-09-11, with its DNS still inactive as of 2026-10-19.
The page carried Polymarket's own branding in its title, "Polymarket | The World's Largest Prediction Market™", so the browser tab and any search snippet looked authentic. Impersonation pages like this get victims to trust a copy of a familiar service and then do what they would normally do there, such as signing in or connecting a wallet to trade. On a clone, those actions hand control to the operator. Victims can lose login credentials or wallet access, and they can lose funds if they approve a transaction or permission the site requests.
Eight of 90 VirusTotal engines flagged the domain on 2026-09-06, the same day PhishDestroy caught it. The flagging vendors were ChainPatrol, alphaMountain.ai, BitDefender, Forcepoint ThreatSeeker, G-Data, Gridinsoft, Kaspersky and SOCRadar. The crypto-focused blocklists of MetaMask, ScamSniffer and SEAL also list it, so wallet users with those protections would have been warned. Spamhaus lists it in its domain blocklist as phishing (DBL_PHISH), and it appears in four AlienVault OTX threat pulses.
The domain was registered on 2026-09-03 through PDR Ltd. (PublicDomainRegistry.com) and was flagged three days later. The site went dark within about a week of registration, which fits a short-lived phishing domain built for a quick campaign. It sat behind Cloudflare in the US, which hides the real origin server. It had a valid certificate from Google Trust Services, so the browser padlock showed nothing wrong.
If you entered a Polymarket login or email on this site, change that password, change it anywhere you reused it, and turn on two-factor authentication. If you connected a wallet, check its token approvals in a revocation tool and revoke any you did not intend. If you signed anything there, move your remaining assets to a fresh wallet. Never type a seed phrase into any site. Defenders should block pollymarket.global and watch for further Polymarket lookalikes that add or swap characters or use alternate extensions.
已存档的页面、网络和扫描器观测结果,按来源和观测时间分组。
观察到: · Retrieved:
| Uuid | 01a076bc-c194-755c-a5b3-669adf10a3ab |
|---|---|
| Final url | https://pollymarket.global/ |
| 状态 | 200 |
| 已重定向 | https-only |
| Redirects | [
{
"to": "https://pollymarket.global/",
"from": "http://pollymarket.global/",
"status": 307
}
] |
| Ip | 172.67.170.51 |
| Contacted IP addresses | [
"172.67.170.51"
] |
| Asns | [
"13335"
] |
| Document hash | cc11d415d9326ccc4e749aed6d2d8f12a28e53d001938f6b4cf2c47a2422dad0 |
| Cookies | [
"PHPSESSID"
] |
| Tls | {
"san": [
"pollymarket.global",
"*.pollymarket.global"
],
"cipher": "AES_128_GCM",
"issuer": "WE1",
"subject": "pollymarket.global",
"protocol": "QUIC",
"valid_to": "2026-12-02T07:35:38Z",
"valid_from": "2026-09-03T06:37:24Z"
} |
| 域名年龄(天) | 3 |
| Apex age days | 3 |
| Tls age days | 3 |
| TLS 有效天数 | 90 |
| Requests | 2 |
| Provider verdicts | {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-60c5e22"
],
"score": 58,
"malicious": true
},
"overall": {
"score": 0,
"malicious": false
}
} |
| HTTP headers | {
"server": "cloudflare",
"content-type": "text/html; charset=UTF-8"
} |
观察到: · Retrieved:
| Uuid | dd5c931c-8fad-4446-84a7-5adb80d6dae1 |
|---|---|
| Final url | https://pollymarket.global/ |
| 状态 | 200 |
| 已重定向 | https-only |
| History | [
{
"url": "http://pollymarket.global/",
"status": 307
},
{
"url": "https://pollymarket.global/",
"status": 200
}
] |
| DOM structure hash | a448064939430babda596da43553e302b7b7b25dff661c2abfdf1fad362e749a |
| Document hash | 1e09f5eaaa7143b5ea2e881850f3c619579a1caf92d7d6555fac5c116b6c380a |
| 域名风险 | [
"Newly Seen Domains",
"Security Risks",
"New Domains"
] |
| Radar rank | {
"bucket": ">200000"
} |
| DNS 记录 | [
{
"name": "pollymarket.global",
"type": "A",
"value": "104.21.28.26"
},
{
"name": "pollymarket.global",
"type": "A",
"value": "172.67.170.51"
},
{
"name": "pollymarket.global",
"type": "AAAA",
"value": "2606:4700:3037::6815:1c1a"
},
{
"name": "pollymarket.global",
"type": "AAAA",
"value": "2606:4700:3032::ac43:aa33"
}
] |
| DNSSEC 有效 | false |
| Ip | 104.21.28.26 |
| 注册记录 | {
"registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
"created": "2026-09-03T07:15:09Z",
"updated": "2026-09-03T07:21:10Z",
"expires": "2027-09-03T07:15:09Z",
"nameservers": [
"rick.ns.cloudflare.com",
"kira.ns.cloudflare.com"
]
} |
不是。PhishDestroy 将 pollymarket.global 归类为“冒充 MetaMask”(风险:关键,100/100),首次检测于 2026-09-06。VirusTotal:8/90 个引擎标记。已列入 Spamhaus DBL。请将该网站视为不安全。
不安全。请勿在 pollymarket.global 连接钱包、签署消息或批准代币。钓鱼网站会请求授权(approve、setApprovalForAll、Permit2),让运营者转走你的资产,而已确认的交易无法撤销。
更改你在该网站输入过的所有密码,并开启双重验证。如果你连接过钱包或签署过任何内容,请撤销授权,并将剩余资金转到新钱包;切勿透露助记词。分步指南:紧急处理指南。
最近检查
对于该 gTLD,上述注册商依据 ICANN 认证协议运营。以下链接提供官方收费标准及现行的 DNS 滥用合规指南。
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Edge-IP 声誉不属于此域。
kira.ns.cloudflare.comrick.ns.cloudflare.com位置信息描述的是 IP 网络。
03e6f5e444a22b23537dbe7c8854e3def5cef9d910da0d16df4b658353bd8610pollymarket.global*.pollymarket.global已保存的证书元数据。未带时区的证书日期按存档原样显示。传输加密并不能证明该网站值得信任。
Google PageSpeed Insights — 移动端性能审核: pollymarket.global · checked Sep 6, 2026
估算时间描述的是一个观测时间窗口。它并不能证明注册商采取了措施,也不代表网站变为不可访问的确切时刻。
比较浏览器与爬虫各自收到的内容,并检查是否存在 Keitaro 流量分发。
pollymarket.global
由监测程序和来源采集器保留的带日期变更记录。最新观测排在最前;来源状态并不能证明站点已被下架。
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
dns_inactive
dns_nxdomain
可访问→不可用
可访问
已存储 79 个仿冒域名
PD-20260906-F4952E Recipient: abuse@publicdomainregistry.com Registrar: PublicDomainRegistry (PDR Ltd.) (India) Policy Violations: Explicit policy to immediately suspend domains used for phishing, 419 scams, identity fraud, malware distribution without prior notice Applicable Laws: IT Act 2000 §§66C–66D (identity theft, cheating by personation), Indian Penal Code §420 / Bharatiya Nyaya Sanhita §318 (fraud)
如果您输入了帐户凭据、个人或付款信息,或者从此域下载了文件,请立即采取措施。以下资源可帮助您报告事件并保护自己。
选择您所在的国家/地区以获取 官方网络犯罪联系人 或 创建投诉草稿 →。
Template-based draft · optional AI wording assistance requires separate consent
请根据您提供过的信息选择相应的步骤。请将本报告的副本与您自己的记录一并保存。
停止使用可疑网站。请通过官方应用或您已信任的网址访问真正的服务。
请将原始邮件、收据、消息和截图保存在安全的地方。基于事实的时间线有助于受理机构了解事件经过。 IC3 evidence guidance ↗
pollymarket.global)即使你并不了解所有细节—— 不管怎样都要提交报告. 即使信息不完整,对调查仍有帮助。
举报并不能保证追回损失或启动调查,但及时、准确的交易数据可以帮助执法机构和服务提供商追踪事件。
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
本报告汇总了已保存的页面快照、注册与网络记录、扫描器结果以及 PhishDestroy 举报历史。每个来源均保留各自的观测日期。打开来源报告即可查看原始结果。
AI 辅助分析的撰写时间: 。该分析描述的是当时可获得的证据;之后的来源核查结果可能有所变化。
快照记录的是当时显示的内容。扫描器结果记录的是该服务商在检查时的评估。有效证书或零检出结果都不能保证安全。