polymarket[.]parts

This domain, polymarket.parts, is actively flagged as a cryptocurrency phishing site targeting users with a fraudulent USDC airdrop on the Polygon network. Analysis indicates the domain was registered on March 2, 2026, through a registrar commonly associated with abusive registrations. Infrastructure review reveals it is hosted on Cloudflare IP 188.114.96.3, part of AS13335, and uses Cloudflare nameservers woz.ns.cloudflare.com and evangeline.ns.cloudflare.com. The site presents a page titled 'USDC Airdrop on Polygon — Polymarket,' mimicking the legitimate Polymarket platform to deceive victims into connecting wallets or disclosing private keys. The domain is classified as an airdrop scam, a tactic frequently used to trick users into authorizing malicious transactions or surrendering credentials under the guise of free token distributions. Security vendor detection remains limited but notable: one of 95 engines on VirusTotal flags the domain, and it appears on three distinct security blocklists. Defenders should note that the domain is actively blocked by at least three security layers, including wallet protection mechanisms. The SSL certificate, issued by Google Trust Services, provides no inherent trust signal, as certificates are routinely issued to malicious domains. What remains uncertain is the scale of victim impact and whether the operators have deployed additional infrastructure to evade takedowns. The 301 HTTP redirect suggests the site may be part of a larger redirection chain, though no secondary domains were provided in the current dataset. Defenders are advised to treat this domain as high-risk and prioritize blocking at the DNS, network, and endpoint levels. Wallet providers and cryptocurrency platforms should issue warnings to users attempting to interact with polymarket.parts, emphasizing that no legitimate airdrop requires private key disclosure or unauthorized transaction approvals.