polymarket[.]com-intern[.]live

Analysis of the domain polymarket.com-intern.live indicates that it has been deployed as a generic phishing site targeting credential collection. The domain was registered through Cloudflare, Inc., and the hosting infrastructure is also provided by Cloudflare, as reflected by the resolved IP address 172.67.138.23, which belongs to AS13335 Cloudflare, Inc., located in the United States. The service was reachable via HTTP/3 and presented an SSL certificate issued by Google Trust Services under the WE1 identifier, demonstrating that legitimate certificate authorities were leveraged to lend credibility. Public scans on VirusTotal show that twelve of ninety‑five security vendors flagged the domain, suggesting a moderate level of detection confidence across the community.

The site returned an HTTP 404 status and its page title reads “Website polymarket.com-intern.live is ready. The content is to be added,” indicating that the content was either removed or never fully deployed before the domain was taken offline. Reputation metrics are poor: the Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist. It is actively blocked by the PhishDestroy blocklist, reinforcing its classification as malicious.

At the time of reporting on July 23, 2026, the domain status is offline, limiting immediate exposure but leaving the underlying infrastructure reusable for future campaigns. Defenders should continue to monitor DNS queries for the IP 172.67.138.23 and related Cloudflare ranges, enforce blocklist updates that include this domain, and consider proactive sink‑hole or DNS‑sink‑blocking for any future resolution attempts. Because the exact phishing page content was not captured before takedown, analysts should treat the site as a credential‑harvesting vector until additional forensic evidence becomes available.