polymarket[.]gg

The domain polymarket.gg was registered on March 27, 2026 through the registrar 1API and is hosted on an AWS Global Accelerator endpoint in the United States, resolving to IP 76.223.105.230. DNS resolution uses GoDaddy's default name servers ns01.domaincontrol.com and ns02.domaincontrol.com. The site presents a valid GoDaddy Secure Certificate (G2) and serves content over HTTPS with HSTS enabled, indicating a recent but legitimate‑looking TLS setup. Technical fingerprinting shows the presence of GoDaddy Website Builder and RequireJS, suggesting a quickly assembled front end. VirusTotal scans have flagged the domain by five of ninety‑four security vendors, and AlienVault OTX lists the domain in twenty‑two threat‑intel pulses, reinforcing its malicious reputation. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that defensive feeds consider it hostile. The page title "Polymarket" and the classification as a "Fake Exchange" indicate that the site is likely attempting to lure users into credential or asset theft under the guise of a cryptocurrency exchange. Current HTTP response code is 200, and the domain remains active as of the report date. While the infrastructure details are clear, the specific phishing content, landing pages, and credential capture mechanisms have not been publicly disclosed, leaving the exact user‑facing tactics uncertain. Defenders should block the domain at network perimeters, update URL filtering lists, and monitor for any related C2 traffic to the AWS endpoint. Incident response teams should treat any user reports involving polymarket.gg as high‑risk and advise affected users to change compromised credentials and review associated accounts.