polymarketlogin[.]us

Analysis of polymarketlogin.us indicates a confirmed brand impersonation phishing domain targeting Amazon users, now offline as of July 23, 2026. The domain was registered on February 21, 2026, and resolved to IP 188.114.96.3, hosted on Cloudflare infrastructure (AS13335). While the page title, 'Polymarket | The World's Largest Prediction Market,' does not directly reference Amazon, the domain is explicitly flagged for impersonating Amazon in an e-commerce scam context. Security vendor detections on VirusTotal reached 15 of 93 engines, and the domain appears on at least one security blocklist, including PhishDestroy.

The SSL certificate is classified as WE1, a low-trust indicator often associated with malicious or newly registered domains. Gridinsoft assigned a trust score of 0/100, reinforcing the domain's high-risk classification. No evidence of a phishing kit or additional page content is available for analysis, limiting further technical attribution.

Defenders should treat this domain as a confirmed phishing threat, particularly for campaigns targeting Amazon customers. Network-level blocking of 188.114.96.3 and monitoring for related domains using similar naming conventions (e.g., 'polymarket' paired with login or brand terms) is recommended. Given the domain's current offline status, no active malicious traffic is expected, but historical logs should be reviewed for prior connections.