polpolygon[.]com

polpolygon.com was registered on 21 February 2026 through Dominet (HK) Limited. The domain resolves to the Cloudflare‑owned address 172.67.212.196, which belongs to AS13335 in the United States. DNS is served by junade.ns.cloudflare.com and shaz.ns.cloudflare.com, both Cloudflare authoritative nameservers. The site presented an SSL certificate issued by Google Trust Services under the WE1 label, and transport security includes HSTS and HTTP/3 support. The page title returned by the live host was “USDT”, and the threat profile identifies the site as a wallet/seed phishing operation that impersonates the Binance brand.

The domain appears on a single public security blocklist and has been listed by PhishDestroy as taken offline. VirusTotal scans show that two of ninety‑five antivirus engines flagged the domain, indicating some malicious behavior despite the low detection rate. Gridinsoft assigned a trust score of 1 out of 100, the lowest possible rating. Infrastructure analysis indicates that the actors leveraged Cloudflare’s free tier to hide the true origin of the server while presenting a legitimate‑looking certificate. Use of the “USDT” title suggests an attempt to lure cryptocurrency users into submitting private keys or seed phrases.

The combination of a brand‑specific target (Binance), a wallet‑focused phishing kit, and a newly registered domain points to a short‑lived campaign that has already been taken down. Defenders should continue to block the domain at network perimeter controls and update URL filtering lists with the observed host name and its associated IP address. Monitoring for additional registrations that use the same registrar (Dominet (HK) Limited) and the same Cloudflare nameservers can help identify follow‑on attempts. Threat‑intel feeds should be enriched with the SSL fingerprint (Google Trust Services / WE1) and the “USDT” page title to improve detection of replicas.