web[.]polymarket-apprestore[.]com

This domain, web.polymarket-apprestore.com, was registered on December 24, 2025, and is assessed as a brand impersonation threat targeting Coinbase. Infrastructure analysis reveals the domain resolves to IP 111.90.156.186, hosted under AS45839 (Shinjiru Technology Sdn Bhd) in Bulgaria, with nameservers ns1.peruadelante.com and ns2.peruadelante.com. The domain was registered through MAT BAO CORPORATION and currently appears offline. No SSL certificate was detected.

The page title, 'Polymarket | The World's Largest Prediction Market,' suggests an attempt to mimic a prediction market platform, though the exact content and functionality remain unconfirmed due to the domain's offline status. Detection data indicates 10 of 93 security vendors on VirusTotal flagged the domain as malicious. It appears on one security blocklist and is blocked by PhishDestroy. The Gridinsoft trust score is 0/100, reinforcing its elevated risk classification.

Defenders should treat this domain as actively malicious, particularly given its association with Coinbase impersonation. Recommended actions include blocking the domain and IP at perimeter security controls, monitoring for related infrastructure reuse (e.g., nameservers, registrar, or hosting provider), and reviewing logs for prior connections. The domain's offline status may indicate takedown efforts, but defenders should remain vigilant for potential re-emergence or similar domains leveraging the same infrastructure.