polyusmarkets[.]com

Analysis indicates that the domain polyusmarkets.com was registered on 21 February 2026 and subsequently pointed to the IP address 104.21.2.180, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented for the site is identified as WE1, suggesting the use of a publicly‑available certificate rather than a brand‑specific credential. The page title returned by the server reads “Polymarket | The World's Largest Prediction Market,” which does not align with the declared impersonation of Google. The site is classified as a tech‑support scam that leverages brand impersonation of Google to lure victims. VirusTotal scans reported that five of ninety‑three AV engines flagged the domain as malicious, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer.

AlienVault OTX recorded the domain in a single threat‑intel pulse, further corroborating its malicious reputation. The domain has been taken offline as of the report date, and no active HTTP response is observable. Uncertainty remains regarding the specific phishing kit or payload delivered, as no additional content analysis is available. The short lifespan of the domain and its reliance on Cloudflare’s shared infrastructure may hinder attribution of the underlying operator.

Defenders should add polyusmarkets.com to deny‑list rules across DNS filtering, proxy, and endpoint protection solutions. Monitoring for future registrations that reuse the same SSL certificate fingerprint or that resolve to the same Cloudflare IP range is advised. Correlation with the observed tech‑support scam pattern targeting Google users may help identify related campaigns. Continuous ingestion of the two blocklist entries and the OTX pulse into security information and event management (SIEM) platforms will ensure timely alerts if the domain reappears.