xn--polymarkt-nib[.]com

This domain, xn--polymarkt-nib.com, is flagged as a high-risk cryptocurrency phishing resource targeting users through deceptive branding. Analysis indicates the domain mimics legitimate cryptocurrency platforms, likely deploying credential harvesting or wallet-draining scripts to exploit victims. No specific drainer kit has been conclusively attributed, though the infrastructure aligns with known phishing toolkits observed in prior campaigns targeting decentralized finance (DeFi) users. Infrastructure analysis reveals the domain was registered on April 04, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 85.239.38.197, which has been linked to multiple phishing operations. Detection metrics show 18 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three independent blocklists. Additionally, the domain is referenced in one threat intelligence pulse on a collaborative threat platform, further corroborating its malicious classification. No entries were found in Google Safe Browsing at the time of analysis. The domain has since been taken offline, likely due to enforcement actions by hosting providers or domain registrars. Despite its current inactive status, residual risk remains due to the transient nature of such threats. Security teams are advised to monitor for re-registration under similar punycode variations or new infrastructure. Organizations should update detection rules to include the identified IP address and registrar patterns, while end-users should verify domain authenticity before interacting with cryptocurrency platforms.