o-5b97bb06[.]pages[.]dev

This domain, o-5b97bb06.pages.dev, is flagged as an active crypto drainer scam targeting users through fraudulent bonus offers. Analysis of the page title, 'I finally tried Polymarket Code and here is how I got my bonus | by cryptocards | Medium,' indicates an attempt to impersonate the Polymarket brand, a known prediction market platform. The content likely lures victims into connecting wallets under the guise of claiming bonuses, a common tactic for deploying drainer scripts that siphon cryptocurrency assets. No specific drainer kit has been attributed yet, but the infrastructure aligns with known crypto phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.47.75 and was registered on June 07, 2026, through Cloudflare Pages. The SSL certificate is issued by Let's Encrypt (identifier: YE2). As of the latest scan, VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged. However, it appears on one security blocklist, PhishDestroy, indicating prior detection by at least one threat intelligence source. No Google Safe Browsing (GSB) flags are currently associated with this domain. The domain remains active, posing an ongoing risk to users who may encounter it through phishing links or malicious advertisements. Response actions should include monitoring for additional blocklist inclusions, analyzing wallet addresses or scripts embedded in the page, and notifying the hosting provider (Cloudflare) for potential takedown. Despite the current low detection rate, the impersonation of a legitimate brand and the use of a deceptive bonus offer warrant caution. Users are advised to verify the authenticity of any crypto-related promotions directly through official channels and avoid connecting wallets to unfamiliar domains.