polymarket[.]pureconnect[.]pro

This domain, polymarket.pureconnect.pro, is identified as a crypto wallet drainer phishing site impersonating the legitimate prediction market platform. Analysis of the page title, 'Polymarket | Le plus grand marché de prédiction au monde,' confirms the impersonation of the Polymarket brand, targeting French-speaking users to induce cryptocurrency wallet connections. The site employs a drainer kit designed to siphon assets upon interaction, a common tactic in cryptocurrency phishing campaigns. No specific drainer kit variant was conclusively identified, but the infrastructure and behavioral patterns align with known wallet-draining frameworks. Technical indicators reveal the domain was registered on March 13, 2026, through the registrar Alexhost, a provider frequently associated with high-risk domains. It resolves to the IP address 146.19.213.11, which has been linked to other phishing and malicious activities. Detection metrics include a VirusTotal score of 7/95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists, and it is actively blocked by multiple cryptocurrency security platforms. Infrastructure analysis further reveals the use of Node.js, Ubuntu, React, Amazon Web Services, Nginx, Next.js, Amazon S3, and Webpack, suggesting a sophisticated deployment likely intended to evade detection and mimic legitimate web applications. As of the latest assessment, polymarket.pureconnect.pro has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure and registration details remain a concern, as threat actors may redeploy the phishing kit under a new domain or IP address. Users who interacted with the site prior to its takedown should immediately revoke any connected wallet permissions and monitor their accounts for unauthorized transactions. Organizations are advised to update security blocklists to include this domain and its associated IP, while users should exercise caution with unsolicited links, particularly those impersonating cryptocurrency platforms. Continuous monitoring of related infrastructure is recommended to mitigate potential resurgence.