xn--polymrket-u1a[.]us-ref[.]cfd

The domain xn--polymrket-u1a.us-ref.cfd was registered on March 17, 2026 through Global Domain Group LLC and is currently flagged as a high‑risk generic phishing site. Analysis classifies the activity as a credential‑harvesting campaign that mimics the legitimate Polymarket service by presenting a page titled “Polymarket — Get Early Access.” The site returns an HTTP 403 response, suggesting intentional restriction of direct access while still serving malicious content to automated scanners.

Infrastructure investigation shows the domain resolves to IP address 104.21.36.221, which belongs to Cloudflare’s network (AS13335). The presence of Cloudflare Browser Insights, Cloudflare’s CDN, and HTTP/3 indicates the attacker is leveraging Cloudflare’s performance layer to obscure origin details. The domain uses Lisa.ns.cloudflare.com and West.ns.cloudflare.com as its authoritative name servers, further confirming reliance on Cloudflare’s DNS services.

Threat intelligence indicates the domain appears on a single security blocklist—PhishDestroy—and has been flagged by 13 out of 95 security vendors on VirusTotal. The Gridinsoft trust score of 0 / 100 reinforces the malicious nature of the site. The combination of a brand‑spoofing page title, the 403 status code, and the low trust score provides a concrete signature that can be used to identify similar phishing infrastructure.

Defenders should immediately block both the punycode domain and its resolved IP address at perimeter and DNS layers. Continuous monitoring of Cloudflare‑hosted domains that reference Polymarket or use similar early‑access phrasing is recommended, as the attacker may duplicate this template. Deploying URL‑filtering rules to drop HTTP requests returning 403 from newly registered domains and incorporating the 13 VirusTotal vendor detections into threat‑feed ingestion will reduce exposure to this active phishing campaign.