pollymarkets[.]io

On July 22 2026 analysts observed that the domain pollymarkets.io is currently taken offline. The domain was registered on February 21 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the Cloudflare network (AS13335) with IP address 172.67.204.201 located in the United States. The authoritative name servers are janet.ns.cloudflare.com and walt.ns.cloudflare.com. No SSL certificate is presented for the host, indicating that HTTPS is not configured.

The page title returned from the HTTP response is “Polymarket | The World's Largest Prediction Market”, which does not reference the advertised brand but the domain is catalogued as a brand‑impersonation campaign targeting Amazon. Threat intelligence feeds have listed the domain on four blocklists, specifically PhishDestroy, MetaMask, ScamSniffer and SEAL, and the domain appears on four security blocklists overall. A Gridinsoft trust score of 0 out of 100 reinforces the malicious classification. VirusTotal analysis shows that four of ninety‑three security vendors have flagged the domain as malicious, further corroborating its hostile intent.

The combination of a recent registration, lack of TLS, placement on multiple blocklists, low trust score, and explicit association with Amazon impersonation suggests a deliberate effort to deceive users, possibly by redirecting traffic to unrelated services such as the Polymarket prediction market site. At present the content of the site has not been captured, and no additional indicators such as malicious payloads or phishing kits have been released. Defenders should immediately deny any network connections to 172.67.204.201 when the queried host name is pollymarkets.io, add the domain to URL filtering and email security policies, and continue monitoring for any re‑appearance of the domain or related infrastructure. Ongoing observation of Cloudflare‑hosted assets associated with this registration may reveal future campaigns.