polymarket.us-ref.sbs

The domain polymarket.us-ref.sbs was identified as a crypto drainer phishing site specifically targeting users of the Polymarket prediction market platform. Analysis confirms the domain impersonated Polymarket’s branding, using the page title 'Polymarket — Get Early Access' to deceive visitors into connecting cryptocurrency wallets, likely to execute unauthorized transactions or drain funds. The domain is currently offline, though its infrastructure remains a documented threat for historical and forensic purposes. Infrastructure analysis reveals the domain was registered on March 15, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.52.6, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate malicious activity. At the time of assessment, polymarket.us-ref.sbs was flagged by 18 of 95 security vendors on VirusTotal, indicating a high-confidence detection rate. The domain appeared on three independent security blocklists, including those maintained by cryptocurrency-specific threat intelligence feeds, further corroborating its malicious classification. The current offline status of polymarket.us-ref.sbs does not eliminate its residual risk, as phishing infrastructure often resurfaces under altered domains or subdomains. Organizations and individuals are advised to block the domain and its associated IP (104.21.52.6) at the network level, including DNS and firewall rules. Users who interacted with the domain should revoke any connected wallet permissions and monitor transaction histories for unauthorized activity. Security teams are encouraged to correlate this domain with other Polymarket-themed phishing campaigns, particularly those using similar subdomain structures (e.g., 'us-ref') or Cloudflare-hosted infrastructure, to preemptively disrupt related threats.