poloniexsone[.]vip

Analysis of the domain poloniexsone.vip indicates it was actively involved in phishing operations targeting cryptocurrency users. Registered on November 14, 2025, through Dynadot LLC, the domain resolved to IP address 104.21.31.185, hosted on Cloudflare's infrastructure (AS13335) in the United States. The domain's nameservers, aria.ns.cloudflare.com and arturo.ns.cloudflare.com, further confirm its reliance on Cloudflare services. At the time of assessment, the domain was taken offline, though its infrastructure remains a point of concern for defenders. The domain exhibited multiple indicators of malicious activity.

It appeared on two security blocklists, PhishDestroy and ScamSniffer, and was assigned a trust score of 0/100 by Gridinsoft. While the page title was recorded as 'Home,' the domain name suggests an intent to impersonate Poloniex, a known cryptocurrency exchange, though no direct evidence of the site's content or functionality was available for analysis. Fourteen of 95 security vendors on VirusTotal flagged the domain as malicious, reinforcing its classification as a phishing threat. Technical analysis reveals the use of Cloudflare services, including HSTS and HTTP/3, alongside an SSL certificate issued by Google Trust Services (WE1). These measures may have been employed to lend an appearance of legitimacy or to evade detection.

The domain's registration details and hosting provider do not provide additional context about the threat actors, but the use of Cloudflare is consistent with tactics observed in other phishing campaigns. Defenders should monitor for any reactivation of this domain or similar infrastructure. Network-level blocking of the IP address 104.21.31.185 and associated domains may mitigate residual risk. Given the domain's offline status, further forensic analysis of its prior activity is not currently possible, but historical logs should be reviewed for connections to this infrastructure.