polymarket-ca[.]com

polymarket-ca.com is an active domain first observed on May 18 2026. The zone is delegated to the Cloudflare nameservers barbara.ns.cloudflare.com and rene.ns.cloudflare.com and resolves to the Cloudflare‑owned address 188.114.96.3, which is geolocated to Canada. The site presents a page titled “Polymarket Canada – is it legal, How It Works, Fees & 2026 Guide”, indicating an attempt to masquerade as an official Polymarket service for Canadian users. The domain is currently blocked by three independent mitigation services – PhishDestroy, MetaMask and SEAL – and appears on three public security blocklists. VirusTotal analysis shows two of ninety‑five scanned security vendors flag the domain as malicious, and AlienVault OTX lists it in one threat‑intel pulse. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The site is served behind Cloudflare, employing Cloudflare Browser Insights and HTTP/3, and presents a Let’s Encrypt certificate signed by the E7 intermediate. The use of Cloudflare’s CDN and TLS termination is typical for phishing infrastructure seeking to hide the true origin of the content while providing a valid HTTPS connection. While the available intelligence confirms a high‑risk phishing posture, the specific credential‑stealing mechanisms and any backend data collection endpoints have not been disclosed publicly. Defenders should block the domain and its resolving IP at network perimeter devices, monitor DNS queries for the associated Cloudflare nameservers, and incorporate the observed indicators – domain name, IP address, nameserver pair, and SSL fingerprint – into threat‑intel feeds. Continuous re‑evaluation is advised as additional analysis may reveal further command‑and‑control or exfiltration components.