app[.]poly-mark[.]xyz

Analysis of app.poly-mark.xyz indicates an active generic phishing infrastructure. The domain was registered on May 01, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served from the Cloudflare network (IP 188.114.97.3, location CA). DNS resolution uses Cloudflare authoritative nameservers gail.ns.cloudflare.com and houston.ns.cloudflare.com. The site presents an HTTP 403 response and presents the page title "Just a moment..."; no further content has been observed. SSL is provided by Let’s Encrypt (certificate identifier E7), confirming the use of a free TLS certificate. Reputation signals are uniformly negative: Gridinsoft assigns a trust score of 0/100, the domain is listed on the PhishDestroy blocklist, and 4 of 91 VirusTotal scanners flag the host. The limited detection history suggests the site is newly deployed and primarily used for credential harvesting. Uncertainty remains regarding the exact phishing campaign payload, target audience, and any additional hosting or redirect layers, as no page content beyond the title has been captured. Defenders should block the domain at network borders, update DNS blacklists with the observed nameservers and IP address, and monitor for similar Cloudflare‑hosted subdomains registered through the same registrar. Continuous re‑scanning is recommended to capture any evolution of the site’s behavior.