claim[.]getpolymar[.]xyz

The domain claim.getpolymar.xyz was registered on April 17 2026 through Dynadot LLC. It is currently flagged as a high‑risk crypto drainer and remains active as of the report date (July 12 2026). The site returns an HTTP 301 redirect and presents the page title “Just a moment…”, which is the only visible content captured.

Infrastructure analysis shows the domain resolves to the IP address 172.67.217.64, which belongs to Cloudflare, Inc. and is geolocated to Canada. The authoritative nameservers are dilbert.ns.cloudflare.com and ursula.ns.cloudflare.com, both Cloudflare‑managed. The TLS certificate is issued by Let’s Encrypt (E8), indicating a valid HTTPS service. The Gridinsoft trust score is 0 out of 100, and VirusTotal reports that one out of ninety‑five security vendors has flagged the domain.

Threat intelligence indicates the site is listed on one security blocklist and is actively blocked by PhishDestroy. The classification as a crypto drainer aligns with the known scam type, but no additional artifacts such as wallet addresses or malicious scripts have been disclosed in the current data set. The page title alone does not reveal the payload or the exact mechanism used to lure victims.

Defenders should treat claim.getpolymar.xyz as malicious and incorporate it into URL filtering, DNS sink‑holing, and endpoint blocking policies. Continuous monitoring of the associated IP address and the Cloudflare nameservers is advised, as the infrastructure could be leveraged for further campaigns. Organizations that handle cryptocurrency transactions should educate users about unsolicited prompts that redirect to domains with similar characteristics.