login-polymarket[.]us

This domain, login-polymarket.us, is identified as a high-risk brand impersonation phishing site designed to deceive users by mimicking Amazon’s official login infrastructure. The site exploits trusted branding to harvest credentials, payment details, or other sensitive information under the guise of a legitimate prediction market platform. Analysis indicates the page title, 'Polymarket | The World's Largest Prediction Market,' is a deliberate misdirection to obscure its true intent, which aligns with known phishing tactics targeting e-commerce users. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, and is currently flagged by 18 out of 95 security vendors on VirusTotal, including entries on three independent security blocklists. It resolves to IP address 172.67.161.181, hosted under AS13335 (Cloudflare, Inc.), and uses a WE1 SSL certificate, a common pattern in phishing campaigns leveraging content delivery networks to mask origin servers. The domain’s presence on multiple threat intelligence feeds further corroborates its malicious classification. Users who visited login-polymarket.us should immediately revoke any entered credentials, particularly for Amazon or linked financial accounts. It is recommended to scan local devices for malware using updated security tools, as phishing sites often deploy secondary payloads. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. If payment details were submitted, contact financial institutions to issue fraud alerts and review recent transactions for anomalies. Organizations should update internal blocklists to prevent future access to this domain and its associated infrastructure.