poly-preregister[.]fun

The domain poly-preregister.fun has been identified as a confirmed airdrop scam specifically targeting users of Polymarket, a decentralized prediction market platform. This domain impersonates legitimate Polymarket branding to deceive victims into participating in fraudulent airdrop schemes, likely designed to harvest credentials or cryptocurrency wallet information. As of the latest verification, the domain has been taken offline, though its infrastructure remains a documented threat in historical records. Analysis of the domain reveals multiple technical indicators of malicious activity. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 22, 2026, the domain resolved to the IP address 172.67.170.5, which is associated with Cloudflare proxy services. The page title, "Polymarket Airdrop | The World's Largest Prediction Market™," directly mimics Polymarket’s official branding. Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 engines detecting it as a threat. Additionally, the domain appears on four distinct security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer. Detected technologies include HSTS, Cloudflare Browser Insights, and HTTP/3, suggesting an attempt to appear legitimate while obfuscating backend infrastructure. The current status of poly-preregister.fun is offline, though the risk of reemergence or similar domains remains high. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users should be educated on recognizing airdrop scams, particularly those impersonating decentralized platforms. Monitoring for newly registered domains with similar naming patterns (e.g., "poly-" prefixes or "preregister" variations) is recommended. Historical threat data should be retained for correlation with future incidents, and any interactions with this domain should be treated as compromised.