extrapoly[.]com

Analysis of extrapoly[.]com indicates an active brand impersonation campaign targeting Polygon users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. HTTP requests receive a 307 redirect response, and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 profile, suggesting legitimate TLS termination. The page title retrieved is "Polygon | The Go-To Blockchain for Payments," confirming the intended brand mimicry.

Technical footprints reveal the use of Unpkg, Twitter Ads, jsDelivr, HubSpot, HSTS, Google Tag Manager, Google Hosted Libraries, and Google Font API, all common to legitimate web services but also leveraged to lend credibility to the malicious page. Malware scanning on VirusTotal shows three of ninety‑three security vendors flagging the domain, and the site appears on a single external blocklist, with PhishDestroy actively blocking it. Independent scoring from Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The campaign employs the Wallet Connect Abuse phishing kit, classifying the operation as a crypto scam that seeks to harvest private keys or authorize illicit wallet transactions.

Defenders should immediately block extrapoly[.]com and its resolving IP at perimeter firewalls and DNS filtering layers, incorporate the domain into internal threat intelligence feeds, and monitor for outbound connections to the Cloudflare address that may indicate compromised client activity. Continuous re‑evaluation of the domain's reputation across additional scanning services is advised, as the low vendor detection count suggests that broader detection may emerge over time.