polymarket.com-events.v2i.us is an impersonation phishing page posing as Polymarket, the crypto prediction market. It presents itself as "Polymarket | The World's Largest Prediction Market™." The address begins with "polymarket.com-events" to look like an official events page, but the domain actually registered is v2i.us, which has no connection to Polymarket. PhishDestroy first flagged it on 2026-09-27, and the site was still live when last checked on 2026-10-19.
How the scam works
Victims usually arrive through a link promising a featured market, an event promotion or a reward. They land on a copy of Polymarket's branding and title. Pages like this then ask visitors to connect a wallet, sign a message or approve a transaction, or to enter login details. Because Polymarket users hold stablecoins and positions in crypto wallets, a single malicious signature or approval can let the operator move those funds. A completed login form hands over account access instead.
Evidence
The classification is backed by independent detections. On 2026-10-07, 13 of 92 VirusTotal engines flagged the domain, including ChainPatrol, alphaMountain.ai, BitDefender, Chong Lua Dao, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. The mix of crypto-focused services and mainstream security vendors means the verdict does not rest on a single source. Spamhaus lists the domain in its DBL as phishing, and it appears on the ScamSniffer and PhishDestroy blocklists.
Infrastructure
The domain was registered on 2026-03-22 through Tucows Domains Inc., about six months before PhishDestroy detected it. That gap suggests it was registered in advance and later put to use for this campaign. The site runs on Google Ireland Limited's cloud network at 35.214.225.47, an address located in the Netherlands. It uses a free Let's Encrypt certificate, so the padlock in the browser only means the connection is encrypted and says nothing about whether the site is legitimate.
What to do
Do not connect a wallet or sign anything on this site. Reach Polymarket only by typing its real address yourself. If you connected a wallet, review and revoke any token approvals you granted, and move remaining funds to a fresh wallet if you signed an unfamiliar message. If you entered login details or an email, change those credentials and enable two-factor authentication wherever it is offered. Defenders should block the v2i.us domain, report it to the registrar and hosting provider, and alert users to deceptive subdomains that start with a brand name.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeReachable but protectedreason: HTTP access restricted50% confidence
Attributionmechanism: Access Restrictionsource: Current Http Probe
Evidence layersAvailability: Reachable but protectedContent: UnknownDNS: ResolvedRegistration: Unknown
Latest HTTP observationReachable but protectedHTTP access restrictedAccess Restriction50%2026-10-19 22:21:58 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-19 22:21:58 UTClast content: 2026-10-19 10:22:12 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 5 identified
N
Nginx
Web serversReverse proxies
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(CA)
