polvip[.]net

On July 24, 2026, analysis of polvip.net was initiated after the domain was observed offline and listed by PhishDestroy. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026 and is hosted on Cloudflare infrastructure (AS13335, United States). DNS resolution points to 172.67.131.211 and the authoritative name servers are amir.ns.cloudflare.com and cass.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate certificate chain but not confirming the authenticity of the site’s content. HTTP headers include HSTS and the service negotiates HTTP/3, consistent with Cloudflare’s default configuration.

The page title reported by the scanner is “USDT”, and the campaign is classified as Wallet/Seed Phishing targeting the Binance brand. The phishing kit identified is “Seed Phrase Phishing”, which typically harvests private recovery phrases. The domain received a Gridinsoft trust score of 0 out of 100 and appears on a single security blocklist. VirusTotal analysis shows that one of ninety‑three AV engines flagged the domain, supporting the suspicion of malicious intent. No additional public threat‑intel feeds (OTX, Safe Browsing) were cited in the supplied data.

Given the combination of a brand‑impersonation lure, a low trust score, presence on a blocklist, and the active flag from an antivirus engine, the domain should be treated as high‑confidence malicious. Defenders are advised to add 172.67.131.211 to network deny lists, enforce DNS sink‑hole rules for polvip.net and its Cloudflare name servers, and monitor for any future re‑registration or similar sub‑domains. Continuous re‑scanning of the domain is recommended in case the offline status changes. The limited visibility of the site content prevents confirmation of any additional payloads, so threat‑intel collection should focus on the observed infrastructure and the identified phishing kit.