polymarket1min[.]com

Analysis of polymarket1min.com confirms its classification as a phishing domain targeting users of the Polymarket prediction platform. The domain, registered on February 21, 2026, through Porkbun LLC, resolved to IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335) in the United States. No SSL certificate was detected, increasing the risk of credential interception or data exposure during user interactions. The page title 'polymarket1min' directly references Polymarket, suggesting an intent to deceive users into believing the site is affiliated with the legitimate platform.

Infrastructure analysis reveals the use of Cloudflare nameservers (jack.ns.cloudflare.com and roxy.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating prior detection and mitigation efforts. VirusTotal reports flagged the domain by 5 of 95 security vendors, though the specific detection signatures or payloads are not detailed in available intelligence. The domain was taken offline by the time of this report, though its prior activity and registration details remain relevant for historical threat analysis.

Defenders should treat this domain as a confirmed phishing threat, particularly for users of Polymarket or similar crypto-based prediction markets. Network-level blocking of the domain and associated IP (188.114.97.3) is recommended to prevent accidental access. Given the lack of SSL and the domain's offline status, further forensic analysis of cached or archived content may be necessary to determine the exact phishing mechanism employed. Registrar and hosting provider abuse reports should be filed to prevent re-registration or reuse of this infrastructure for similar campaigns.