mainnetplasma[.]lat

PhishDestroy identifies mainnetplasma.lat as an active crypto drainer impersonating Plasma's stablecoin infrastructure, luring users with false promises of instant payments. The domain uses the page title 'Plasma - Stablecoin infrastructure for instant payments' to mimic legitimate crypto services, exploiting trust in established protocols. This campaign specifically targets cryptocurrency users by presenting a fraudulent interface designed to siphon funds via fraudulent transaction approvals. This domain was flagged by VirusTotal with only 1 out of 95 security vendors detecting its malicious nature as of the latest scan. The domain is registered through Porkbun, LLC, obtained a Let's Encrypt SSL certificate to appear legitimate, and was created on September 25, 2025. It resolves to IP address 44.230.85.241 and remains actively hosted despite minimal detection coverage, indicating a rapidly evolving threat that evades traditional security measures. Users who visited mainnetplasma.lat should immediately revoke any transaction approvals or connected wallet permissions via blockchain explorers or wallet settings. Do not interact with any prompts or transaction requests originating from this domain. Clear browser cache and cookies, then scan devices for malware using reputable antivirus tools. Report the domain to your wallet provider and relevant crypto platforms to prevent further abuse. Monitor wallet activity closely for unauthorized transactions.