polymarket[.]com-v2[.]v2i[.]us

As of July 12, 2026, the domain polymarket.com-v2.v2i.us has been confirmed as a high-risk phishing site. This domain, registered through Tucows Domains Inc. on March 23, 2026, is currently active and has been flagged by 12 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain resolves to the IP address 35.214.225.47 and is hosted on Amazon Web Services, with Nginx serving as the web server. The presence of Let's Encrypt SSL certificate suggests an attempt to appear legitimate and secure, which is a common tactic among phishing operators. The site also integrates various advertising technologies, including Twitter Ads, Reddit Ads, LiveIntent, Google Analytics, and Facebook Pixel, which could be used to drive traffic or track user activity. The domain appears on one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0/100, further corroborating its malicious nature. Defenders should take immediate action to block this domain and educate users about the risks associated with visiting or interacting with it. Given the domain's recent creation and its integration with multiple advertising and analytics services, it is likely that this phishing operation is part of a coordinated campaign to exploit users' trust in the Polymarket brand. Infrastructure analysis reveals a sophisticated setup that could be leveraged to mimic legitimate services and steal sensitive information. Security teams should monitor for similar domain patterns and IP addresses to prevent broader exposure to this threat. Additionally, users should be cautious of unexpected emails or messages directing them to this domain and should verify the legitimacy of any communication related to Polymarket through official channels.