Analysis conducted on July 25, 2026 identifies polymarket.special.markets as a phishing endpoint that was recently taken offline. Infrastructure analysis reveals the domain was hosted behind Cloudflare (AS13335) and resolved to the IPv6 address 2606:4700:3037::6815:59f0, geolocated in the United States. The domain was registered through Cloudflare, Inc., and no nameservers were detected at the time of assessment, indicated by the NS_NOT_FOUND status. The SSL certificate was issued by Google Trust Services under the WE1 intermediate, a common configuration for Cloudflare-proxied domains.
The endpoint returned an HTTP 404 status with the page title ERR_NGROK_3200 - The endpoint polymarket.special.markets is offline, suggesting prior use of ngrok tunneling for hosting, though the exact phishing payload or targeted brand remains unconfirmed. Detection data shows the domain appeared on one security blocklist, specifically PhishDestroy, and was flagged by 12 of 95 security vendors on VirusTotal, indicating moderate detection coverage. Technologies detected include Cloudflare and HTTP/3, consistent with modern phishing infrastructure designed to evade IP-based blocking. Defenders should treat this domain as part of a broader phishing campaign leveraging Cloudflare’s CDN and ngrok for temporary hosting.
The absence of nameservers and the offline status suggest the campaign may have been short-lived or disrupted. Network administrators are advised to block the resolved IPv6 address and monitor for related domains registered through Cloudflare with similar naming patterns. Further investigation into the ngrok tunnel logs, if accessible, could reveal additional compromised endpoints or campaign infrastructure. The domain’s current offline status limits deeper forensic analysis, but the available indicators align with known phishing tactics observed in 2026.
For the registrable domain special.markets behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprintae45d7cfce938480049e6837c789bc1ca38d6263382291f1301926540558dcfdCertificate names · 1 SANs
special.markets
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-13 22:06:48 UTC
RDAP registration未知
Observed timelinelast reachable: 2026-10-13 22:06:48 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
技术 · 2 identified
Cloudflare
CDN
Web infrastructure and security company providing CDN, DDoS mitigation, and DNS services.
This timeline displays historical security and status checkpoints observed by the PhishDestroy automated monitoring network. It records domain lifecycle updates, scanner changes, and threat telemetry over time.
14 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
Web Archive
Preserved in 互联网档案馆 — historical evidence archived
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups+
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels+
Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
Send the report. Keep outgoing report records and recipient information when available.
Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
I am writing to report a confirmed wallet compromise that resulted in the theft of funds from my Polymarket-connected wallet. The attacker drained my USDC balance via a malicious phishing site mimicking your platform.
### Incident Details:
- Phishing Site Used: https://po
1 report filed for polymarket.special.markets (1 written by a person) · category: Phishing · source checked
“I am writing to report a confirmed wallet compromise that resulted in the theft of funds from my Polymarket-connected wallet. The attacker drained my USDC balance via a malicious phishing site mimicking your platform.
### Incident Details:
- Phishing Site Used: https://polymarket.special.markets (Note: I mistakenly attempted to log in multiple times, believing it was official.)
- Compromised Wallet Address (please blacklist):`0x4F46459146b7Bf7572eC82235136399a0c906687`
- Theft Tran”
— reported by Anonymous on Nov 3, 2025 · Source: ChainAbuse (TRM Labs) — full report and evidence there.
(US)
