registration-poly[.]com

Analysis of registration-poly.com indicates a newly registered crypto‑airdrop phishing site. The domain was created on 2026‑03‑06 and registered through NiceNIC International Group Co., Limited. DNS resolves to the IPv4 address 74.0.32.219, which is advertised as belonging to AS399486 (12651980 CANADA INC.) and is geolocated in Great Britain. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. No TLS certificate is presented, and the HTTP service is currently offline, consistent with the reported status.

The only visible artifact is the page title “$POLY Airdrop — Polymarket”, matching the “Airdrop Scam” phishing kit documented in threat intel. The site is listed on three independent blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows three of ninety‑four scanners flagging the domain as malicious, reinforcing the classification as a crypto‑related phishing operation. The available evidence confirms the presence of a targeted airdrop lure aimed at Polymarket users, but the content of the landing page and any credential‑harvesting mechanisms have not been captured.

Uncertainty remains regarding the extent of victim outreach, the persistence of the hosting infrastructure, and whether additional domains share the same IP or kit. Defenders should immediately block resolution of registration-poly.com and its IP address at perimeter and DNS layers, enforce denial of any traffic to the identified name servers, and add the domain to internal phishing and malware blocklists. Continuous monitoring of the IP’s ASN for new host registrations and periodic re‑scanning on VirusTotal or similar services are recommended to detect any re‑activation. Given the elevated risk rating, security teams should also alert end‑users about unsolicited Polymarket airdrop messages and advise verification through official channels.