well, I'm mostly concerned about this change not being visible in Wikipedia's edit history for that page, hinting at this being a very sophisticated attack that could hit a lot more pages / domains.
It seems like the Wikipedia page for Polymarket now links to the domain polymarcet [dot] com as official website, which seems like it could be a targeted attack. How does one report something like that?
Afaik all 2-letter TLDs are ccTLDs, which means they must be a country code of some country and are managed by it. There's no country with "os" yet, so to make the TLD available one would need to found a new country first!