pokladot[.]net

pokladot.net is a recently registered domain (created 21 Feb 2026) that was observed serving a page titled “Polkadot: Scalable Multi‑Chain Blockchain Platform for Web3 Interoperability”. The page content suggests a crypto‑related lure, and the intelligence tags the operation as a “Crypto Scam” that impersonates the brand “Across”. The site was hosted behind Cloudflare (AS13335) and resolved to 104.21.48.1, an IP address located in the United States. The SSL certificate presented is identified as “WE1”, indicating a publicly trusted certificate but offering no domain‑specific validation.

Reputation services have flagged the domain: three of ninety‑five VirusTotal scanners marked it malicious, Gridinsoft assigned a trust score of 0 / 100, and the domain appears on four independent security blocklists. It has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, and the current status is listed as offline. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED.

While the page title and scam classification provide a concrete indication of the threat vector, the exact phishing layout, credential‑capture mechanisms, and any associated command‑and‑control infrastructure remain undocumented. Consequently, defenders should ensure that DNS and proxy filters block resolution to 104.21.48.1 for the host name pokladot.net, add the domain to local blocklists, monitor for newly registered domains that mimic the Polkadot or Across brand naming patterns, and consider applying threat‑intel feeds that include the observed blocklist entries. Continuous re‑evaluation is advised in case the domain is re‑activated or similar infrastructure is reused.