xn--polymarkt-ihb[.]app

PhishDestroy identifies xn--polymarkt-ihb.app as a phishing domain specifically designed to impersonate Polymarket, the world's largest prediction market. This site attempts to steal login credentials and potentially cryptocurrency assets by mimicking the legitimate Polymarket platform. The threat is classified as generic phishing with high risk, targeting users of decentralized prediction markets.

Evidence of malicious intent is substantial. VirusTotal reports 12 out of 95 security vendors flagging this domain as malicious. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 26, 2026, a very recent creation date typical of phishing campaigns. It resolves to IP address 147.45.110.175, which is associated with other fraudulent activities. Additionally, the domain appears on 3 security blocklists and is found in 1 threat intelligence pulse on AlienVault OTX. The SSL certificate from Let's Encrypt provides no guarantee of legitimacy, as such certificates are easily obtained.

Users who have visited this domain should immediately change their Polymarket passwords and enable two-factor authentication if not already active. Scan devices for malware, monitor accounts for unauthorized transactions, and consider freezing any linked crypto wallets. PhishDestroy advises never entering credentials on sites accessed via unexpected links and always verifying the official domain (polymarket.com) before interacting.