polymarket-poc[.]pages[.]dev

This domain, polymarket-poc.pages.dev, is flagged as a brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site masquerades as Polymarket, a legitimate prediction market, to exploit user trust and potentially facilitate unauthorized transactions or credential harvesting. No direct evidence of a crypto drainer kit was observed, but the combination of brand misrepresentation and cryptocurrency-related context elevates the risk of financial fraud or account compromise. Infrastructure analysis reveals the domain was registered on March 02, 2026, through Cloudflare, Inc., a registrar frequently leveraged for both legitimate and malicious purposes. The domain resolves to the IP address 172.66.45.28, a Cloudflare-hosted endpoint, which aligns with the observed SSL certificate issued by Google Trust Services. Detection metrics show the domain appears on three security blocklists, with VirusTotal reporting 2 out of 95 security vendors flagging it as malicious. The site employs technologies such as Chart.js, jsDelivr, and HTTP/3, which are commonly used in legitimate applications but can also be abused to enhance the credibility of fraudulent pages. As of the latest assessment, polymarket-poc.pages.dev has been taken offline, reducing immediate exposure to users. However, the domain's infrastructure remains registered, and the risk of reactivation persists. Organizations and individuals are advised to monitor for renewed activity, particularly in cryptocurrency-related contexts, and to implement domain-based blocking for 172.66.45.28 and associated indicators. Users should verify the authenticity of any platform claiming affiliation with Coinbase or Polymarket by cross-referencing official communication channels and avoiding interaction with untrusted domains.