polymarket[.]register-coinlist[.]io

Analysis of polymarket.register-coinlist.io, observed on July 25 2026, shows that the domain was registered on 21 February 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare‑owned address 172.67.207.76 (AS13335, United States). The site presents the page title “Polymarket - CoinList” and responds with HTTP 403, indicating that direct access is denied. TLS termination is provided by a Google Trust Services certificate issued to the WE1 authority, confirming the use of standard HTTPS infrastructure. Cloudflare services, including HTTP/3, are detected, and the authoritative nameservers are george.ns.cloudflare.com and joselyn.ns.cloudflare.com.

VirusTotal reports six positive detections out of ninety‑three scanners, and the domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—each flagging it for wallet/seed phishing. The Gridinsoft trust score of 0 / 100 reinforces the malicious assessment. The classification in the intelligence as “Wallet/Seed Phishing” aligns with the observed targeting of cryptocurrency wallets, although the exact payload or credential‑capture page has not been captured because the site is currently offline and returns a 403 status. Defenders should treat the domain as malicious.

Immediate actions include adding the domain and its resolving IP to network‑level deny lists, updating web‑gateway filters with the four blocklist entries, and monitoring for any future re‑activation or similar domain registrations that reuse the “register‑coinlist.io” suffix. Continuous observation of Cloudflare‑hosted IP ranges for anomalous traffic patterns is advised, as the infrastructure is shared with many legitimate services. Because the site is offline, dynamic analysis is limited; however, the combination of multiple vendor detections, blocklist listings, a zero‑score trust rating, and the specific wallet‑phishing label provides sufficient evidence to justify a high‑confidence block.