polymarket[.]org[.]es

Analysis of polymarket.org.es indicates a high-risk phishing domain targeting Spanish-speaking users with content related to Polymarket, a prediction market platform. The domain was registered on May 21, 2026, and currently resolves to IP address 104.21.48.27, hosted on Cloudflare infrastructure in Canada. The SSL certificate is issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious sites. The page title, 'Polymarket España 2026: ¿Qué es y es legal? Cómo funciona y guía,' suggests an attempt to impersonate or reference Polymarket, though the exact nature of the content remains unconfirmed as the site has not been directly analyzed. Security vendors have flagged the domain on three blocklists, and it appears in one AlienVault OTX threat intelligence pulse. One of 91 vendors on VirusTotal detects the domain as malicious, though this single detection does not provide conclusive evidence of intent. The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, further indicating its association with phishing or fraudulent activity. The HTTP status returns 200, confirming the site is currently accessible. Defenders should treat polymarket.org.es as a potential phishing threat, particularly given its thematic alignment with Polymarket and its presence on multiple security blocklists. The domain’s recent registration and use of Cloudflare are consistent with patterns observed in phishing campaigns. No definitive evidence of credential harvesting, crypto draining, or other specific attack vectors is available at this time, but the domain’s infrastructure and blocking status warrant immediate caution. Network-level blocking or monitoring for connections to 104.21.48.27 is recommended until further analysis can be conducted.