app[.]poliygon[.]xyz

As of July 12, 2026, the domain app.poliygon.xyz has been identified as a high-risk phishing site. The domain, created on March 02, 2026, is currently active and has been flagged by 6 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion among the cybersecurity community. The site's infrastructure is notable for its use of Cloudflare and HTTP/3, which can sometimes be indicative of efforts to mask malicious activities or enhance performance for fraudulent purposes. Additionally, the domain resolves to the IP address 188.114.97.3, a detail that can assist in identifying related malicious infrastructure. The SSL certificate is issued by Google Trust Services, which can lend a false sense of security to unsuspecting users. However, the presence of this certificate does not negate the domain's malicious intent, as it is primarily used to encrypt data and not to verify the legitimacy of the site. The page title 'paliygon.xyz | 504: Gateway time-out' suggests that the site may be experiencing technical issues or intentionally configured to display an error message to deter detailed inspection. Despite this, the domain's inclusion on four security blocklists and its blocking by several reputable security tools, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, clearly indicate its involvement in malicious activities. Gridinsoft's trust score of 0/100 further corroborates the high-risk status of this domain. Defenders should take immediate action to block access to app.poliygon.xyz and alert users to its dangers. Regular monitoring and updating of blocklists are recommended to prevent potential phishing attacks. The exact content and purpose of the site have not been fully analyzed, but the combination of high-risk indicators and active blocking by security solutions should be sufficient to classify it as a confirmed phishing site.