polymarket[.]lever-labs[.]com

This domain, polymarket.lever-labs.com, is flagged as a high-risk generic phishing site specializing in cryptocurrency wallet-draining attacks. Analysis indicates it impersonates the legitimate Polymarket platform, a decentralized prediction market, to deceive users into connecting their wallets. The site likely employs a drainer kit designed to siphon funds upon interaction, a common tactic in crypto-phishing campaigns targeting Web3 users. No specific drainer kit variant has been confirmed, but the infrastructure aligns with known wallet-draining phishing operations. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on April 17, 2025, through NAMECHEAP INC and currently resolves to IP address 104.21.26.39, hosted on Cloudflare's network (AS13335). VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains to appear legitimate. The page title 'Just a moment...' suggests the use of Cloudflare protection or a placeholder page masking the actual phishing content. As of the latest assessment, polymarket.lever-labs.com remains active and poses a significant risk to users. The domain is blocked by multiple security providers, including MetaMask and SEAL, indicating widespread recognition of its malicious nature. Response actions should include immediate blacklisting, DNS sinkholing, and user education to prevent wallet connections. Despite these measures, the domain's continued operation and Cloudflare hosting present an ongoing threat, particularly to users unaware of phishing tactics in the cryptocurrency space. Users are advised to verify domain authenticity and avoid interacting with any unsolicited links or wallet connection prompts.