claim[.]p0lymarket[.]today

The domain claim.p0lymarket.today was registered on April 20, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the Cloudflare‑managed address 104.21.72.78, and the authoritative name servers are gail.ns.cloudflare.com and houston.ns.cloudflare.com. The site presents a valid TLS certificate issued by Let’s Encrypt (E7), indicating standard HTTPS support, yet HTTP requests return a 403 status code, suggesting access restrictions or intentional denial of service.

Threat intelligence flags the domain as a crypto drainer. Fourteen of ninety‑five antivirus engines on VirusTotal have identified it as malicious, and Gridinsoft assigns a trust score of zero out of one hundred, the lowest possible rating. PhishDestroy has already added the domain to its blocklist, and it appears on an additional security blocklist, reinforcing the consensus that the domain is being used for illicit cryptocurrency extraction.

Analysis of the underlying infrastructure reveals no overt indicators of a benign service. The Cloudflare IP location is listed as CA, but the use of Cloudflare alone does not confirm legitimacy. The 403 response limits direct observation of payloads or landing pages, leaving the exact delivery mechanism of the crypto‑draining campaign uncertain. No public page content, brand impersonation, or malware sample has been disclosed, so the specific tactics employed remain unverified.

Defenders should treat claim.p0lymarket.today as hostile. Immediate mitigation actions include adding the domain and its resolved IP address 104.21.72.78 to network blocklists, enforcing DNS sinkholing, and monitoring outbound connections for attempts to contact the domain. Continuous re‑evaluation is advised, as future changes to the HTTP response or the emergence of malware samples could provide additional insight into the threat actor’s methods.