polymarketairdrop[.]xyz

polymarketairdrop.xyz was registered on 14 October 2025 through Ultahost, Inc. The domain resolves to the IPv4 address 45.12.2.67, which is announced by AS6698 (Virtual Systems LLC) and geolocated to Ukraine. No TLS certificate is presented, indicating the site is served over plain HTTP. The active page title, captured from the live endpoint before takedown, reads “Polymarket Airdrop – Claim Your Tokens,” matching the known scam pattern of a fake token airdrop. Analysis of the hosting environment shows the domain is delegated to four name servers: ns1.fluentairdrop.xyz, ns2.fluentairdrop.xyz, ns1.polymarketairdrop.xyz, and ns2.polyma (truncated), suggesting the infrastructure is shared with other airdrop‑related sites.

The site is associated with the “Airdrop Scam” phishing kit and has been blocked by the PhishDestroy community blocklist. VirusTotal scans report that eight of ninety‑five anti‑malware engines flag the domain as malicious, providing independent confirmation of its threat status. AlienVault OTX lists the domain in a single threat‑intelligence pulse, and it appears on one additional security blocklist. The domain’s risk level is classified as elevated, and its current status is offline, indicating that the hosting provider has taken the site down or the operators have removed it.

Defenders should continue to enforce blocklist rules for the domain and its resolved IP address, add the observed name servers to deny‑list policies, and monitor for re‑registration or reuse of the IP space. Because the site served no HTTPS certificate, any attempt to interact with the URL would expose users to clear‑text traffic and potential credential capture. The presence of multiple security detections across independent platforms justifies the elevated rating and warrants inclusion in network‑level filtering and endpoint protection updates.