polymarket-cn[.]com

This domain, polymarket-cn.com, is identified as a credential theft operation specifically targeting users of the Polymarket platform. The site masquerades as the official Polymarket login portal, using the brand name in its page title (polymarket官网-polymarket官网登录入口 -【AG直营第一品牌】) to deceive visitors into entering sensitive account credentials. Analysis indicates no direct association with cryptocurrency drainer kits, but the focus on credential harvesting suggests intent to compromise accounts for subsequent unauthorized transactions or data exfiltration. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on November 28, 2025, through Unstoppable Domains, an atypical registrar for legitimate financial platforms. It resolves to the IP address 107.149.151.99, hosted on AS54600 (PEG TECH INC) in the United States, a network segment frequently observed in phishing campaigns. The domain lacks an SSL certificate, a critical red flag for any site handling user credentials. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. No presence in Google Safe Browsing databases was noted at the time of assessment. The domain is currently offline, likely due to takedown actions or voluntary suspension following detection. However, the elevated risk persists due to the domain's recent creation date and the potential for infrastructure reuse. Users who may have interacted with this site are advised to immediately reset credentials for any accounts accessed through it, enable multi-factor authentication, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address, while security teams should investigate potential lateral movement from compromised accounts.