vault-plasma[.]to

vault-plasma.to was registered through Namecheap on 21 February 2026. The domain uses the authoritative nameservers dns101.registrar-servers.com and dns102.registrar-servers.com and resolves to the IPv4 address 23.111.160.242, which belongs to AS29802 HIVELOCITY, Inc. and is geolocated in the United States. An HTTPS service is present with an SSL certificate identified as R11, and a plain HTTP GET returns status code 200 with the HTML title “Plasma”. The site is classified as an investment‑scam phishing operation.

Independent threat‑intelligence feeds have added the domain to two blocklists, specifically PhishDestroy and ScamSniffer, and it appears on two additional security blocklists. VirusTotal analysis shows that two of ninety‑three scanned scanners flagged the domain as malicious. The current operational status is offline, indicating that the site has been taken down or is no longer reachable.

While the available evidence confirms the domain’s involvement in a phishing campaign targeting investors, no further technical artefacts such as malicious payloads, credential‑harvesting forms, or redirect chains have been publicly disclosed. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any re‑use, and consider adding the ASN and the observed nameserver pair to watchlists. Ongoing verification of the domain’s offline status is recommended, as re‑activation could occur if the operators migrate the infrastructure to a new host.