polymarkets[.]at

Analysis indicates that the domain polymarkets.at is actively engaged in a high-risk brand impersonation campaign targeting Ethereum, as documented on July 12, 2026. The domain was registered on November 23, 2025, through Gransy s.r.o. (registrar ID 609), a registrar previously associated with abusive domain registrations. Infrastructure analysis reveals the domain resolves to the IP address 176.119.156.212, which is hosted on AS48347 (JSC Mediasoft ekspert) and geolocated in Russia. The server employs Nginx and presents an SSL certificate issued by Let's Encrypt (R13), a common configuration observed in both legitimate and malicious infrastructure. The page title, 'Polymarket | The World's Largest Prediction Market,' directly mimics the branding of a known prediction market platform, suggesting an intent to deceive users into believing the site is affiliated with or identical to the legitimate service. The scam type is classified as a crypto scam, aligning with the impersonation of Ethereum-related services. Detection metrics from security vendors indicate that 21 of 95 engines on VirusTotal have flagged the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on at least one security blocklist and is currently blocked by PhishDestroy. Nameserver configuration points to a.dnspod.com, b.dnspod.com, and c.dnspod.com, a pattern consistent with domains managed through DNSPod, a provider frequently utilized in malicious campaigns. The domain remains active as of the report date, with an HTTP status of 200, confirming its operational status. Defenders are advised to treat this domain as a confirmed threat, prioritize blocking resolutions to 176.119.156.212, and monitor associated infrastructure for further malicious activity. The exact content and functionality of the site have not yet been analyzed, but the available evidence supports classification as a high-risk crypto scam.