polynow.fun

This domain, www.polynow.fun, is a confirmed crypto drainer phishing site targeting Discord users, assessed as high-risk and currently offline. Analysis indicates the domain was registered on December 19, 2025, through HOSTINGER operations, UAB, and resolves to the IP address 64.29.17.1, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain uses Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com), a common pattern observed in phishing campaigns leveraging cloud-based hosting for rapid deployment and evasion. The page title, '1 new message,' aligns with social engineering tactics designed to lure victims into interacting with a fraudulent Discord notification.

The domain is flagged by one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. While VirusTotal shows only one security vendor detection, this limited visibility does not diminish the domain's confirmed association with the Wallet Connect Abuse drainer kit, a toolset frequently used to siphon cryptocurrency from compromised wallets. Infrastructure analysis reveals the absence of an SSL certificate, a red flag for phishing sites that often omit encryption to avoid certificate transparency logs or to reduce operational complexity.

The domain's short lifespan—less than eight months at the time of this report—is consistent with disposable phishing infrastructure. Defenders should treat this domain as part of a broader Discord-themed crypto drainer campaign, particularly given its use of social media phishing tactics and the specific drainer kit identified. Recommended actions include blocking the domain and its resolving IP (64.29.17.1) at the network level, monitoring for related domains registered through the same registrar or hosted on similar infrastructure, and alerting users to the '1 new message' social engineering lure.