polymarkettrade[.]app

The domain polymarkettrade.app was registered on 2026-02-21 through Porkbun LLC and resolves to the IPv4 address 216.150.16.193, which belongs to AS16509 operated by Amazon.com, Inc., geolocated in the United States. The site presents a TLS certificate issued by Let’s Encrypt (R13) and issues an HTTP 307 redirect. Automated analysis identifies the page title “Live Prediction Markets”, while the underlying stack includes Node.js, React, Next.js, Vercel, HSTS, and Webpack. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Four of ninety‑three VirusTotal scanners reported malicious activity, and the Gridinsoft trust score is 0/100, indicating a high likelihood of abuse. Classification data label the campaign as a crypto‑related phishing operation and assign a high risk rating. The infrastructure is actively hosted, and no evidence contradicts the current active status. Defenders should add the IP address 216.150.16.193 and the domain name to block lists, monitor DNS queries for the three Porkbun nameservers (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com), and enforce outbound filtering for TLS connections to Let’s Encrypt‑issued sites that exhibit similar technology fingerprints. Because the content beyond the title has not been manually inspected, further investigation is recommended to confirm the presence of credential‑collection forms or malicious payloads. Continuous re‑scanning is advised to capture any changes in detection counts or blocklist inclusion.