polymarket[.]emanuelelocatelli[.]me

The domain polymarket.emanuelelocatelli.me is currently active and presents a login page titled “Login - Polymarket Bot”, indicating an attempt to impersonate the Polymarket platform. The domain was registered on 14 May 2026 and resolves to the IP address 77.42.17.240, which is hosted in Finland under the Cloud Hel1 provider. Network analysis shows the host is covered by a Let’s Encrypt certificate (R13) and returns an HTTP 302 response, a common pattern for credential‑phishing redirects. Reputation services flag the site as high‑risk: Gridinsoft assigns a trust score of 0 / 100, two of ninety‑two VirusTotal scanners have reported detections, and the domain is listed on three public blocklists, including PhishDestroy, MetaMask and SEAL. The combination of a recent registration, low trust score, active blocklist listings, and the presence of a brand‑specific login interface suggests a credential‑phishing campaign targeting Polymarket users. Observers have not disclosed additional infrastructure such as ASN or email infrastructure, leaving the full scope of the operation uncertain. Defenders should block the domain at network perimeter, monitor DNS queries for the host, and enforce multi‑factor authentication for any Polymarket accounts. Users receiving unsolicited login prompts referencing Polymarket should be instructed to verify URLs and avoid entering credentials on this domain.