polymarket[.]portal-drops[.]icu

This domain, polymarket.portal-drops.icu, is an impersonation scam targeting Gmail users. Despite its page title of "Google," the site is designed to deceive visitors into believing they are accessing a legitimate Gmail or Google-related service. The threat posed is credential harvesting or unauthorized data collection through brand impersonation, as the site mimics Google's interface to trick users into entering sensitive information.

Technical evidence confirms the malicious nature of this domain. VirusTotal reports 6 detections out of 95 scanners. The domain was registered on 2025-10-20 through Dynadot LLC, hosted on IP 64.233.180.99 (AS15169 Google LLC, United States), and uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). No SSL certificate is present, indicating no encrypted connection. The domain is flagged by ChainPatrol, alphaMountain.ai, CRDF, CyRadar, and Forcepoint ThreatSeeker, with one blocklist entry.

The domain is currently offline but remains a high risk due to its impersonation of a trusted brand. GridinSoft trust rating is 0 out of 100, and the DOM risk score is 10, confirming its malicious intent. Users should avoid any interaction with this domain as it may be reactivated for future phishing campaigns.