plume[.]airsdropalert[.]click

This domain, plume.airsdropalert.click, poses as a cryptocurrency airdrop platform to deceive users into disclosing wallet credentials or approving malicious transactions. Such schemes often mimic legitimate token distributions, tricking victims into connecting wallets to drainers that siphon funds automatically. The threat primarily targets users seeking free crypto rewards, exploiting urgency and perceived legitimacy to bypass caution. Analysis indicates the domain was registered on November 5, 2025, through Dynadot, LLC, and resolves to the IP address 188.114.96.3. It is flagged by 10 out of 95 security vendors on VirusTotal, with a page title of 'Welcome to nginx!' suggesting default server misconfiguration or deliberate obfuscation. The domain appears on one security blocklist and uses an SSL certificate issued by Google Trust Services, which does not validate its legitimacy as a safe platform. If you visited plume.airsdropalert.click, immediately disconnect any connected wallets and revoke permissions for suspicious smart contracts using a blockchain explorer. Scan your device for malware, as phishing sites may deploy additional payloads. Monitor wallet activity for unauthorized transactions and report the domain to relevant security platforms to aid in takedown efforts. Avoid interacting with unsolicited airdrop promotions, especially those requiring wallet connections or seed phrase entry.