polymarket-event-page[.]pages[.]dev

This domain is under investigation for crypto scam impersonation, specifically targeting users through brand spoofing of a legitimate cryptocurrency prediction platform. Analysis indicates the site was designed to deceive visitors into connecting wallets or entering credentials under false pretenses, likely functioning as a crypto drainer or fake login portal. Infrastructure analysis reveals the domain polymarket-event-page.pages.dev was registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.125. The domain creation date is listed as May 31, 2026, which may indicate falsified registration data or a placeholder. Despite a VirusTotal detection score of 0/95, the domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, and the site employs HSTS, Cloudflare CDN, and HTTP/3, suggesting an attempt to mimic legitimate security practices. The page title explicitly uses the name 'Polymarket,' reinforcing the impersonation angle. Mitigation steps for this threat type include immediate blocking of the domain and associated IP at the network level. Users should be advised to verify wallet connection prompts through official channels only and to inspect domain names for subtle misspellings or unusual subdomains. Organizations should update endpoint protection rules to flag domains hosted on Cloudflare Pages with recent creation dates or inconsistent registration details. Wallet providers are recommended to monitor for transaction requests originating from this domain or its infrastructure and to implement additional verification steps for high-risk interactions.