polygonscan[.]live

Analysis of the domain polygonscan.live, created on 21 February 2026 and currently offline, indicates a targeted brand‑impersonation campaign aimed at Polygon users. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. Registration was performed through NiceNIC International Group Co., Limited, and the authoritative nameservers are magdalena.ns.cloudflare.com and aldo.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The SSL certificate presented by the site is issued by Google Trust Services under the WE1 profile, providing a legitimate‑looking HTTPS indicator. VirusTotal has recorded 14 detections out of 93 scanning engines, demonstrating a moderate level of malicious classification.

The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy filtering service. AlienVault OTX references the domain in a single threat‑intelligence pulse, further corroborating its association with malicious activity. Automated technology profiling identified Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support, all of which are consistent with the hosting provider’s feature set. The only visible HTTP response is a “404 Not Found” page title, and no additional content has been captured because the site is presently taken offline.

Consequently, the specific payload or credential‑stealing mechanisms remain unknown. Nevertheless, the combination of brand impersonation, the “Crypto Scam” classification, and the detection history suggests the domain was intended to lure Polygon cryptocurrency users into fraudulent schemes. Defenders should add polygonscan.live to URL filtering and domain‑blocking policies, monitor for newly registered domains that share the “polygonscan” pattern, and consider broader protective measures for Polygon‑related traffic.