polynominaldex[.]xyz

This domain, polynominaldex.xyz, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is delegated to the Cloudflare nameservers malcolm.ns.cloudflare.com and zainab.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc. and geolocated in the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 root, indicating the use of a valid HTTPS connection despite the malicious purpose. HTTP/3 support was observed, confirming modern web protocol usage. The page title returned by the server reads “Polynomial Finance — Decentralized Perp Exchange & Cross‑Chain DEX,” suggesting an attempt to masquerade as a cryptocurrency exchange platform.

No visual or functional analysis of the landing page is available because the service has been taken offline, and the current HTTP status is not reachable. Consequently, the exact content and any credential‑harvesting forms cannot be confirmed. Reputation checks show the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sink‑hole. VirusTotal scans reported ten of ninety‑three security vendors flagging the domain as malicious, providing independent corroboration of its threat potential.

No additional public threat‑intel feeds, such as OTX or Google Safe Browsing, were cited in the available data. Given the observed infrastructure, the presence of a reputable TLS certificate, and the alignment of the page title with a legitimate DeFi service, defenders should treat polynominaldex.xyz as a high‑confidence phishing indicator. Recommended actions include adding the domain to network‑level deny lists, updating endpoint security signatures to block connections to the associated IP, and monitoring for any future re‑activation. Analysts should also track any new DNS changes or SSL re‑issuances that could signal resurrection of the campaign.