domain-d1j[.]pages[.]dev

This domain is a confirmed phishing site designed to impersonate the legitimate Polymarket platform's early access registration page. Analysis indicates the site specifically targets users seeking early access to cryptocurrency prediction markets, with the primary objective of harvesting login credentials and cryptocurrency wallet information. The fraudulent page mimics the authentic Polymarket branding and interface, creating a convincing facade to deceive visitors into submitting sensitive information. Infrastructure analysis reveals multiple concerning indicators. The domain, registered through Cloudflare on March 31, 2026, resolves to IP address 188.114.96.3 and is currently flagged by 12 out of 95 security vendors on VirusTotal. The domain appears on three distinct security blocklists and is actively blocked by multiple security systems. Technical detection shows the site employs HSTS and HTTP/3 protocols, with Cloudflare's infrastructure providing hosting and protection services. The creation date being set in the future suggests potential domain generation algorithm usage or registry manipulation. Users who visited this domain should immediately take protective measures. Any credentials or wallet information entered should be considered compromised and require immediate rotation. Cryptocurrency wallet users must transfer assets to new wallets and revoke any connected dApp permissions. System scans for malware are recommended, particularly for browser-based extensions that may have been installed. Affected parties should monitor financial accounts for unauthorized transactions and report the incident to relevant security teams. The domain's current offline status does not eliminate the risk to previously exposed credentials or systems.