polhud[.]com

The domain polhud.com has been identified as a brand impersonation phishing resource specifically targeting Binance, a major cryptocurrency exchange platform. Analysis confirms the threat type as fraudulent USDT (Tether) transaction solicitation, designed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. As of the latest verification, the domain has been taken offline, though prior activity remains a documented security concern. Infrastructure analysis reveals that polhud.com was registered through Dominet (HK) Limited on February 21, 2026, an anomalous creation date suggesting potential domain spoofing or preemptive registration for malicious use. The domain resolved to the IP address 104.21.94.24, a Cloudflare-associated endpoint commonly leveraged to obfuscate origin servers and evade detection. Security telemetry indicates the domain was flagged by 4 of 95 vendors on VirusTotal, while appearing on a single security blocklist. Additional indicators include a Gridinsoft trust score of 8 out of 100, reinforcing its classification as high-risk infrastructure. Technologies detected on the domain included HTTP/3, HSTS, and Cloudflare Browser Insights, further suggesting an attempt to mimic legitimate financial service platforms. Current status confirms polhud.com is offline, though historical activity and residual risk necessitate continued vigilance. Organizations and end-users are advised to block the domain and associated IP address 104.21.94.24 at the network perimeter. Cryptocurrency users should verify all transaction URLs against official Binance domains and enable multi-factor authentication for all exchange-related accounts. Security teams are encouraged to monitor for recurring registrations under the same registrar or IP range, as threat actors frequently re-deploy similar infrastructure. Proactive threat hunting for related indicators, including the unique seed b3226b, is recommended to preemptively disrupt future campaigns.