polymarket[.]com-intern[.]co

On 25 July 2026 the domain polymarket.com-intern.co was observed to be offline. The authoritative WHOIS data shows the domain was created on 21 November 2025 and registered through Cloudflare, Inc., using Cloudflare’s default nameservers marissa.ns.cloudflare.com and rajeev.ns.cloudflare.com. DNS resolution points the name to the IP address 104.21.23.93, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The web server responded with HTTP status 404 and the page title returned “Website polymarket.com-intern.co is ready. The content is to be added”, indicating a placeholder page rather than active phishing content. TLS termination is provided by Google Trust Services under the WE1 certificate, confirming the use of a legitimate SSL chain.

Reputation services have flagged the domain. PhishDestroy has listed it as malicious and the domain appears on one external blocklist. VirusTotal scans returned three positive detections out of ninety‑five AV engines, reinforcing the suspicion of abuse. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, and the site was identified as employing Cloudflare and HTTP/3 technologies. No additional intelligence such as OTX references or Safe Browsing entries were present in the supplied data.

The available evidence points to a short‑lived phishing infrastructure that was likely deployed to impersonate the legitimate service polymarket.com, as suggested by the domain name construction. Because the site is currently offline, immediate traffic blocking may have limited impact, but the underlying IP address is shared among many Cloudflare customers, so blanket IP blocks could cause collateral disruption. Defensive operators should continue to block the domain at DNS and proxy layers, monitor for re‑registration, and add the host to threat‑intel feeds.