Polymarket Phishing Domains: The 2026 Lookalike List and the Verification Habit That Beats Them

The drainer campaigns of 2026 share one infrastructure habit: lookalike domains. polymarket.0auth.select isn’t Polymarket — it’s Polymarket as a subdomain of 0auth.select. That one trick defeats most users’ domain instinct, and it’s only the most visible of the patterns. Here’s the anatomy of domain deception, the active 2026 examples, and the verification habit that beats every variant.

What are Polymarket phishing domains?

Lookalike domains hosting drainer portals — pages that mimic Polymarket and request connect+sign (approvals or 7702 delegations). The active patterns documented this year: subdomain planting — polymarket.anything.tld where the real domain is anything.tld (the 0auth.select campaign is the flagship example); typosquats — one character off the real domain (polymarkt, polymarket-io); hyphen traps (polymarket-us.com — the real product doesn’t live there); and TLD swaps (polymarket.net/.org — the real domain is .net for the hub ecosystem, but the platform itself is the one bookmarked from official sources). The scam catalog tracks the campaign families; the email wave that drives traffic to these domains is in fake Polymarket emails.

The subdomain trick, decoded

Browsers read domains right-to-left: in polymarket.0auth.select, the registrable domain is 0auth.select — “polymarket” is just a subdomain its owner chose. Anything before the registerable domain (everything up to the last two labels, roughly) is decorative. Visually, users scan left-to-right and see “polymarket” first — which is the whole deception. Same trick powers login.polymarket.example.io and every “brand.tld” variant you’ll ever meet.

The verification habit (30 seconds, unbreakable)

1. Bookmark the official domain once — from the official source, not from any message.
2. Navigate by bookmark, always. No email links, no DM links, no ad links, no “quick search” — the habit that defeats 100% of lookalikes because it never reads them.
3. If you’re already on a URL: read the registrable domain right-to-left (everything between the last two dots, plus the TLD). That’s the domain you’re actually trusting.
4. Check the certificate but don’t trust it alone — phishers have valid TLS too; the padlock says “encrypted,” not “honest.”
5. One signature test: any page asking you to connect+sign to “claim,” “verify,” or “unlock” something — and you didn’t navigate there by bookmark — is hostile until proven otherwise.

I signed on a lookalike — now what

Minutes matter: revoke approvals, check for a 7702 delegation (the CLI check), move remaining funds to a fresh wallet — the first-24-hours sequence. Ignore any DM offering help (second-wave scams — fake recovery services).

FAQ

What is the polymarket.0auth.select domain? A phishing domain: “polymarket” is a subdomain — the actual registrable domain is 0auth.select, owned by the drainer campaign. It is not affiliated with Polymarket; signatures captured there drain wallets.

How do I check if a Polymarket URL is real? Read the registrable domain right-to-left (labels between the last two dots plus the TLD), and compare to your bookmark of the official site. Everything to the left of the registrable domain — including the word “polymarket” — proves nothing.

Can phishing sites have valid HTTPS certificates? Yes — TLS proves encryption, not identity. The padlock on a lookalike domain is normal. Domain verification (right-to-left reading + bookmarks) is the actual defense.

What’s the safest way to access Polymarket? Bookmark the official domain once from an official source and navigate exclusively by that bookmark — email/DM/ad links and web searches for “polymarket” are how lookalikes get their traffic.

I connected my wallet to a phishing site but signed nothing — am I safe? A connection alone reveals only your address — no approvals, no drain. The risk starts at signature (approval or delegation). Check for any signatures you don’t remember (see the 7702 check) and harden going forward.

Educational content, not financial advice. Not affiliated with Polymarket. Last updated October 2026.