polymarketmaker[.]io

This domain, polymarketmaker.io, is under investigation as a potential phishing site targeting users of trading or prediction market platforms. Registered on June 05, 2026, through GoDaddy.com, LLC, the domain remains active and resolves to the IP address 185.158.133.1. Infrastructure analysis reveals it uses nameservers ns37.domaincontrol.com and ns38.domaincontrol.com, which are associated with GoDaddy's hosting services. While VirusTotal scans by 91 vendors returned no detections as of the latest check, this absence does not confirm the domain's legitimacy.

The domain appears on one security blocklist, specifically PhishDestroy, indicating prior suspicion or confirmed malicious activity. The registration details and hosting provider do not inherently indicate malicious intent, but the domain's recent creation and presence on a blocklist warrant caution. The exact nature of the phishing scheme—whether it involves credential harvesting, fraudulent transactions, or another form of deception—remains unconfirmed, as the site's content has not been fully analyzed.

Defenders are advised to monitor network traffic for connections to 185.158.133.1 or the domain itself, particularly in environments where trading or prediction market activity is common. Blocking the domain at the perimeter or via endpoint protection may mitigate potential risks until further analysis clarifies its intent. Additional scrutiny of related infrastructure, such as the hosting IP or associated domains, may reveal broader campaign patterns.