eng-polymarket[.]com[.]chronoboost-en[.]com

This domain, eng-polymarket.com.chronoboost-en.com, is flagged as a high-risk credential phishing site impersonating Polymarket, a prediction markets platform. Analysis indicates the threat actor designed the page to mimic the official Polymarket interface, using the page title 'Polymarket® Official | Live Prediction Markets & Event Trading' to deceive users into submitting login credentials or financial details. No drainer kit signatures were detected in initial scans, though the domain exhibits characteristics consistent with large-scale phishing infrastructure. Infrastructure analysis reveals the domain resolves to IP address 80.82.77.215 and was registered through REGISTER S.P.A. on May 1, 2026, an anomalous creation date suggesting domain spoofing or registry manipulation. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing status remains unconfirmed at the time of analysis. No active blocklist entries were identified beyond the VirusTotal detections, though HTTP/3 protocol usage and a Let's Encrypt SSL certificate indicate an attempt to appear legitimate. The domain remains active as of this report, with no takedown or sinkholing observed. Users are advised to avoid interaction, particularly credential submission or wallet connections. Organizations should monitor for related domains registered through the same registrar and IP range, as this infrastructure may support additional phishing campaigns. The anomalous creation date and low detection rate suggest this campaign may evade automated defenses, warranting manual review of related indicators.