polymarket[.]initialize[.]markets

This domain is flagged for elevated risk due to brand impersonation targeting Polymarket, a decentralized prediction market platform. The specific threat involves a crypto wallet drainer mechanism, designed to trick users into connecting wallets to a fraudulent interface, enabling unauthorized asset transfers. Analysis indicates the domain was crafted to exploit trust in the Polymarket brand, presenting a high-risk vector for financial loss among cryptocurrency users. Infrastructure analysis reveals the domain polymarket.initialize.markets resolves to IP address 198.54.126.144 and was registered through NameCheap, Inc. on February 21, 2026. It is detected by 6 out of 95 security vendors on VirusTotal and appears on three security blocklists, including MetaMask and SEAL. The domain uses PHP and LiteSpeed technologies, with an SSL certificate issued by Sectigo Limited. A Gridinsoft trust score of 0/100 further confirms its malicious classification. The page title, 'Connect Wallet - Polymarket,' directly mimics legitimate wallet connection prompts, increasing the likelihood of successful deception. Mitigation requires immediate action from both users and security teams. Users who interacted with this domain should revoke all connected wallet permissions via their blockchain explorer and monitor transaction histories for unauthorized activity. Security teams should block the domain and its resolving IP (198.54.126.144) at the network level, update endpoint protection rules to flag similar impersonation patterns, and alert users to verify domain authenticity before connecting wallets. Given the domain's current offline status, continuous monitoring for re-emergence or similar variants (e.g., initialize.markets subdomains) is critical to prevent further exploitation.