polycash[.]fun

This domain, polycash.fun, is identified as a crypto drainer phishing site designed to impersonate legitimate cryptocurrency wallet services. Analysis indicates the site targets users by presenting a fraudulent interface to harvest wallet credentials and drain digital assets. No specific brand impersonation was confirmed, but the infrastructure aligns with known drainer kits used in prior campaigns. The domain exhibits characteristics typical of short-lived phishing operations, including rapid deployment and minimal branding to evade detection. Technical indicators reveal the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 63.176.8.218, which has been linked to other malicious infrastructure. VirusTotal detections show 6 out of 95 security vendors flagging this domain as malicious, while it appears on three security blocklists. The site employs Netlify for hosting and enforces HSTS, a tactic occasionally used to lend false legitimacy to phishing pages. Google Safe Browsing status is not explicitly provided, but the domain’s presence on multiple blocklists suggests active malicious classification. As of the latest assessment, polycash.fun has been taken offline, likely due to enforcement actions by hosting providers or security vendors. The domain was blocked by MetaMask, SEAL, and PhishDestroy, indicating prior detection by wallet security tools. Despite its current offline status, the domain remains a residual risk due to potential re-activation or migration to new infrastructure. Users who interacted with the site should immediately revoke wallet permissions, transfer remaining assets to a secure wallet, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.