app[.]plasmaxpl[.]com

The domain app.plasmaxpl.com was registered on February 21, 2026 and currently resolves to the Cloudflare address 172.67.152.250, which is associated with ASN 13335 in the United States. The SSL certificate presented (identified as WE1) is valid for the host, indicating that the operator has taken steps to appear legitimate to browsers. VirusTotal records show that nine out of ninety-three security vendors have flagged the domain, suggesting a moderate level of detection across the ecosystem.

The domain is listed on two public blocklists, specifically PhishDestroy and ScamSniffer, reinforcing the assessment that it is being used for malicious purposes. The site’s status is marked as offline at the time of this report, which may indicate a temporary takedown or an operational pause by the threat actor. While the exact brand or service being spoofed is not disclosed in the available intelligence, the classification as generic phishing implies that the site is likely intended to harvest credentials or personal data.

Defenders should continue to block traffic to the domain at perimeter devices, update threat intelligence feeds with the observed indicators, and monitor the associated IP address for any resurgence of activity. Because the hosting is provided through Cloudflare, any future re‑hosting of the payload may leverage the same IP range, so broader IP reputation checks are advisable. In the absence of direct page content, analysts should treat any email or URL that references app.plasmaxpl.com as suspicious and instruct users to avoid interaction until a full content analysis can be performed.