poly-market-bot[.]com

This domain, poly-market-bot.com, is identified as a credential theft operation targeting users of cryptocurrency platforms, specifically impersonating PolyVision AI. Analysis indicates the site presents a fraudulent login interface designed to harvest user credentials, which can lead to unauthorized access to digital wallets or exchange accounts. The threat extends beyond generic phishing by mimicking a legitimate service, increasing the likelihood of successful deception among users familiar with the brand. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 07, 2026, through NameCheap, Inc., and resolves to the IP address 172.67.185.37. Security vendors on VirusTotal flagged the domain at a rate of 5/95, while it appears on three independent security blocklists. Additional threat intelligence sources, including AlienVault OTX, have documented the domain in two distinct pulses, further corroborating its malicious classification. The use of Cloudflare and HTTP/3 suggests an attempt to obscure hosting details and evade detection. Users who visited poly-market-bot.com or entered credentials on the site should take immediate action to mitigate risk. First, revoke any active sessions or tokens associated with cryptocurrency wallets or exchanges linked to the entered credentials. Second, enable multi-factor authentication on all financial and crypto-related accounts to prevent unauthorized access. Third, monitor accounts for suspicious transactions and report any anomalies to the respective platform. Given the domain’s offline status, users should remain vigilant for similar threats, as threat actors often re-deploy infrastructure under new domains.