polymarket-verify[.]com

This domain, polymarket-verify.com, is actively engaged in credential phishing targeting users of the Polymarket prediction market platform. Analysis indicates the site functions as a fake login portal designed to harvest cryptocurrency wallet credentials and authentication tokens. The domain remains operational as of the latest verification, with no takedown or mitigation measures observed. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or establish long-term persistence. It resolves to the IP address 188.114.97.3, hosted on autonomous system AS13335, a network frequently utilized for content delivery and proxy services. Security vendors have flagged the domain as malicious, with 17 of 95 VirusTotal engines detecting it as phishing infrastructure. The site is currently blocked by three independent security blocklists, including PhishDestroy and MetaMask, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate, issued by Google Trust Services under the WE1 intermediate, provides encrypted connections but does not mitigate the underlying threat. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider has identified the domain as suspicious, though no enforcement action has been taken. The risk posed by polymarket-verify.com is classified as high due to its active status, direct targeting of cryptocurrency users, and the potential for financial loss through credential theft. Users are advised to avoid interacting with the domain and to verify all URLs through official Polymarket communication channels. Network administrators should implement blocklist updates to prevent access to 188.114.97.3 and polymarket-verify.com at the DNS and firewall levels. Cryptocurrency wallet providers are recommended to monitor for authentication attempts originating from this domain and to alert users who may have entered credentials. Given the domain's use of a content delivery network, additional scrutiny of related IP ranges and certificate issuances is warranted to identify potential secondary infrastructure.