Is polymarket-app.top a scam? TrustSniffer's high-risk assessment: 0/100

Overview

The captured page for this website is not a product site but a security interstitial from the site's CDN provider. It warns that the site "has been reported for potential phishing" and offers an "Ignore & Proceed" button. The domain name pairs a prediction-market-style brand label with "app" on an uncommon, low-cost top-level domain, which suggests an application-style front end. The warning page shows no service description, monetisation model, login form or payment flow, so the site's actual purpose and business model cannot be established from what was captured.

Scam/Impersonation Risk

Multiple independent contradictions are present, and they carry decisive weight. The domain is blacklisted: several threat-intelligence detection sources currently flag it as malicious or suspicious, and the CDN provider's own warning page independently describes it as reported for potential phishing. This is a reputational finding about the domain, not proof of a specific attack. No brand impersonation was confirmed from page content, and no conflicting legal identities were found. However, the underlying pages were never visible, so any impersonation of the brand-like domain label cannot be ruled out. The sandbox run also recorded a mismatch between the requested and final destination, which fits a site that redirects visitors or behaves differently once the warning is bypassed. The page itself loaded a high share of external resources and produced repeated console errors. These details are secondary, but they are consistent with the elevated-risk picture. Evidence:

• Domain registered 2026-09-28 (~0.06 years, about 23 days old), so the domain has almost no operating history.
• 2 archive snapshots, both captured on 2026-09-28 (1 year tracked), so there is no meaningful historical record of legitimate operation.
• Homepage capture returned an access-denied status with a phishing interstitial, offering the visitor an "Ignore & Proceed" option.
• Threat-intelligence aggregation: 3 detections marked malicious and 1 suspicious, against 54 harmless and 34 undetected results.

Regulatory Verification Notes

The captured material contains no legal, terms, privacy or about pages. It names no operating company, licence, registration number or regulator, so no licensing status or corporate identity can be assessed. Identity remains unverified, and nothing links the site to a genuine operator. This is a verification gap that cannot be closed from the evidence. Because the site is blacklisted, it is a secondary concern. The registration is through Eranet International Limited, with registrant details redacted. This is recorded as an administrative detail, not as an identity contradiction. No third-party broker or regulatory listing matched the domain. Evidence:

• Registrar is Eranet International Limited; the registration runs to 2027-09-28 with registrant details privacy-redacted.
• Served from AS13335 (Cloudflare, Inc., US).
• TLS certificate issued by YE2 (domain-validated only), valid to 2026-12-27. Domain validation confirms control of the domain but says nothing about who operates it.
• The captured page lists no licence authority, licence number, company name or contact channel.

What to Verify Next

The brand-like domain label should be compared with the official domain published by the genuine service it appears to evoke, using an independently sourced address such as a known bookmark or official social profile. Any claim of licensing or operation by a named entity should be checked directly with the relevant regulator's public register, since the site itself offers no such details to check. If the site later displays contact channels, they should be confirmed through an independent route before any engagement. Re-analysis is warranted only if the reputation listings are formally cleared and the full site content becomes observable. Evidence:

• The domain is under a month old and has no archive history, so no prior legitimate use can be cited.
• Registrant identity is privacy-redacted, so ownership cannot be confirmed from registration data.
• The homepage capture exposed no contact, legal or licensing information to confirm.

Summary Verdict

The overall posture is high-risk. Convergent threat-intelligence listings, the phishing warning, a very recent registration and the absence of any verifiable identity or operating history point the same way. The valid certificate and standard infrastructure do not offset that reputational evidence. The site cannot be treated as trustworthy, and sensitive interaction with it is unsafe.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge node; no origin server could be observed. The valid TLS certificate and the CDN's bot protection are mitigating factors only, and they do not indicate legitimacy. Edge-only visibility also prevents independent verification of where the content is hosted and can mask rapid content changes. The domain's very recent registration and sparse DNS footprint are consistent with short-lived infrastructure, but this is an unconfirmed heuristic.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, deposits or any financial interaction. Read-only viewing, if needed at all, should be limited to isolated or throwaway environments. The "Ignore & Proceed" option on the warning page should not be used. Anyone who has already interacted with the site should change reused passwords and review wallet permissions and account activity immediately.