claim[.]polymarketx[.]today

claim.polymarketx.today is currently active and hosts a page titled “Suspected Misleading Website | Cloudflare”. The domain was registered on 2026-04-21 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 172.67.218.234, which is owned by Cloudflare, Inc. in Canada. The site presents a valid TLS certificate issued by Let’s Encrypt (E8). HTTP responses return status code 403. Nameservers are gail.ns.cloudflare.com and houston.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure. VirusTotal analysis shows that 14 of 94 scanning engines flag the domain, indicating a moderate level of malicious detection. It is listed on one security blocklist and is explicitly blocked by PhishDestroy. The threat is classified as a brand-impersonation crypto scam targeting Cloudflare’s brand. Risk level is high and the seed “3abacc” identifies this indicator as unique. Defenders should immediately add the domain to outbound and inbound DNS block lists, enforce URL filtering, and monitor for any connections to 172.67.218.234. Because the site returns a 403 response, automated retrieval may be limited, but security appliances should still log attempts. Continuous re-evaluation is advised since the content of the landing page has not been publicly analysed beyond the title, and further payloads could be delivered after initial access.