polymarket[.]special[.]markets

Analysis conducted on July 25, 2026 identifies polymarket.special.markets as a phishing endpoint that was recently taken offline. Infrastructure analysis reveals the domain was hosted behind Cloudflare (AS13335) and resolved to the IPv6 address 2606:4700:3037::6815:59f0, geolocated in the United States. The domain was registered through Cloudflare, Inc., and no nameservers were detected at the time of assessment, indicated by the NS_NOT_FOUND status. The SSL certificate was issued by Google Trust Services under the WE1 intermediate, a common configuration for Cloudflare-proxied domains.

The endpoint returned an HTTP 404 status with the page title ERR_NGROK_3200 - The endpoint polymarket.special.markets is offline, suggesting prior use of ngrok tunneling for hosting, though the exact phishing payload or targeted brand remains unconfirmed. Detection data shows the domain appeared on one security blocklist, specifically PhishDestroy, and was flagged by 12 of 95 security vendors on VirusTotal, indicating moderate detection coverage. Technologies detected include Cloudflare and HTTP/3, consistent with modern phishing infrastructure designed to evade IP-based blocking. Defenders should treat this domain as part of a broader phishing campaign leveraging Cloudflare’s CDN and ngrok for temporary hosting.

The absence of nameservers and the offline status suggest the campaign may have been short-lived or disrupted. Network administrators are advised to block the resolved IPv6 address and monitor for related domains registered through Cloudflare with similar naming patterns. Further investigation into the ngrok tunnel logs, if accessible, could reveal additional compromised endpoints or campaign infrastructure. The domain’s current offline status limits deeper forensic analysis, but the available indicators align with known phishing tactics observed in 2026.