polyclaude[.]cc

polyclaude.cc was registered on June 22, 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED and delegated to Cloudflare name servers mia.ns.cloudflare.com and owen.ns.cloudflare.com. DNS resolution points to 2.26.254.142, an address assigned to AS198550 NODE HOST LIMITED in the Netherlands. The host presents a valid TLS certificate issued by Let’s Encrypt (identifier YE1), indicating that HTTPS connections are encrypted. The site’s HTML title, as captured, reads "PolyClaude — Automated Trading Agent for Polymarket", suggesting an attempt to lure users interested in the Polymarket platform. Reputation services have flagged the domain.

It appears on three independent blocklists and is specifically listed by PhishDestroy, MetaMask, and SEAL as a malicious resource. VirusTotal analysis shows three of ninety‑one scanners flagged the domain, providing additional confirmation of suspicious behavior. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, reinforcing the assessment of high risk. The overall risk level is marked as elevated. As of the report date, July 24, 2026, the domain is offline, but the infrastructure remains observable.

The combination of recent registration, use of a reputable CDN, a legitimate‑looking TLS certificate, and low trust scores is consistent with a short‑lived phishing campaign targeting users of Polymarket. No further content has been captured, so the exact phishing vector cannot be described. Defenders should block DNS resolution to 2.26.254.142 for the polyclaude.cc domain, add the domain to local and network‑level URL filtering lists, and monitor for any related activity originating from the AS198550 range. Because the site leveraged a Cloudflare front‑end, additional scrutiny of traffic to the associated name servers may be warranted. Incident response teams should also consider notifying affected users of Polymarket about potential credential compromise attempts linked to this domain.