polyclaude[.]pro

This domain, polyclaude.pro, is flagged as a high-risk generic phishing threat. Analysis indicates it operates as a fraudulent AI service portal, designed to harvest user credentials, session tokens, and financial information under the guise of legitimate cloud-based AI tools. The infrastructure exhibits characteristics consistent with credential phishing and payment fraud campaigns, where victims are lured through deceptive interfaces mimicking trusted platforms. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on June 1, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. It appears on three security blocklists and is actively blocked by at least three major threat intelligence feeds, including MetaMask’s fraud detection systems. VirusTotal reports 10 out of 95 security vendors flagging the domain, with detections spanning phishing, fraud, and malicious website categories. AlienVault OTX records the domain in four distinct threat intelligence pulses, further corroborating its malicious classification. No legitimate hosting history or benign traffic patterns have been observed. Mitigation requires immediate action from both end users and network administrators. Users should avoid interacting with polyclaude.pro or any subdomains, particularly those requesting login credentials or payment details. Security teams should implement DNS-based blocking for the domain across all corporate and perimeter defenses. Given the domain’s registration through a high-risk registrar and its presence on multiple blocklists, organizations should treat all associated traffic as malicious. Credential rotation is recommended for any accounts potentially exposed to this infrastructure. Monitoring for related domains using the same registrar or naming patterns (e.g., AI-themed typosquatting) should be prioritized to preempt follow-on attacks.