polymarketl[.]co

This domain, polymarketl.co, is identified as a cryptocurrency phishing site designed to deceive users into disclosing wallet credentials or transferring digital assets under false pretenses. The site mimics a legitimate decentralized prediction market platform, leveraging similar branding and interface elements to exploit trust. Victims are typically lured through social engineering tactics, such as fake promotions or urgent account verification requests, which direct them to the fraudulent domain. Analysis indicates the domain is flagged by 5 out of 95 security vendors on VirusTotal, confirming its malicious classification. Infrastructure analysis reveals the domain resolves to the IP address 104.21.13.153, utilizing Cloudflare for hosting and protection, which is a common tactic to obscure the true origin of phishing infrastructure. The site employs HSTS and HTTP/3 protocols, along with a Google Trust Services SSL certificate, to appear legitimate. It has been detected in 2 AlienVault OTX threat intelligence pulses and appears on 3 security blocklists, including MetaMask and PhishDestroy. Users who visited polymarketl.co should immediately cease all interaction with the site. If any credentials or wallet information were entered, revoke access to connected applications and transfer assets to a new, secure wallet. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams or platforms to assist in mitigating further risks. Avoid clicking on links from untrusted sources and verify domain authenticity through official channels before engaging with decentralized platforms.