polygpt[.]net

This domain, polygpt.net, is identified as a credential theft operation targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to harvest usernames, passwords, and session tokens, potentially leading to unauthorized account access or identity compromise. The threat is classified as high-risk due to its active status and targeted nature. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 30, 2026, an unusual future date suggesting potential registration irregularities. It currently resolves to IP address 104.21.71.73 and holds an SSL certificate issued by Google Trust Services, which may lend false legitimacy. Only 1 of 95 security vendors on VirusTotal flagged this domain as malicious, indicating low detection coverage and potential evasion of traditional security measures. Users who visited polygpt.net or entered credentials on the site should immediately revoke active sessions, reset passwords for all accounts accessed from the same device, and enable multi-factor authentication where available. Monitor financial and communication accounts for unauthorized activity, as stolen credentials may be exploited across multiple platforms. Network administrators are advised to block the domain and associated IP address (104.21.71.73) at the perimeter level to prevent further exposure.