polymarket[.]verafy[.]us

This domain is flagged as a high-risk generic phishing threat targeting users through a fraudulent verification portal impersonating Verafy. Analysis indicates the domain is designed to harvest credentials or sensitive information under the guise of a legitimate verification service, leveraging deceptive page titles and infrastructure to appear authentic. Infrastructure analysis reveals the domain polymarket.verafy.us resolves to IP address 188.114.97.3 and is registered through OwnRegistrar, Inc. It was created on May 20, 2026, an anomalous future date suggesting potential registration irregularities or obfuscation tactics. The domain is detected by 14 out of 95 security vendors on VirusTotal, holds a Gridinsoft trust score of 0/100, and appears on three security blocklists (PhishDestroy, ScamSniffer, OISD). Detected technologies include Node.js, Vue.js, Nuxt.js, Cloudflare Browser Insights, and Cloudflare CDN, with HTTP/3 support. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. Mitigation steps specific to this threat type include immediate blocking of the domain and its resolving IP (188.114.97.3) at the network perimeter. Security teams should monitor for connections to this IP or domain in logs and proxy data, particularly from endpoints that handle sensitive authentication workflows. User awareness training should emphasize the risks of verification-themed phishing pages, especially those hosted on newly registered or low-reputation domains. Given the use of Cloudflare, analysts should inspect HTTP headers and TLS fingerprints for anomalous patterns. If credentials were entered, reset them immediately and enable multi-factor authentication on all critical accounts.