mainnet-plasma[.]help

This domain is flagged as an elevated-risk phishing site specifically targeting users of Plasma stablecoin infrastructure. Analysis indicates the site mimics legitimate stablecoin payment portals to harvest credentials, private keys, or other sensitive financial data from cryptocurrency users. The threat type is classified as a cryptocurrency phishing portal, designed to exploit trust in decentralized finance platforms. Infrastructure analysis reveals the domain mainnet-plasma.help was registered on May 02, 2026, through Porkbun, LLC, and resolves to IP address 52.33.207.7. Security vendors on VirusTotal flagged the domain at a 5/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The site appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. Detected technologies include Webflow, jsDelivr, HSTS, Google Tag Manager, Google Hosted Libraries, Google Font API, Google Analytics, and CookieYes, suggesting a professionally constructed phishing framework. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address across all network security layers. Organizations should update endpoint protection rules to detect and prevent access to mainnet-plasma.help and similar cryptocurrency-themed phishing domains. Users should be educated on verifying domain authenticity before entering credentials, particularly for financial or blockchain-related services. Security teams should monitor for indicators of compromise, including unexpected outbound connections to 52.33.207.7 or related infrastructure. Given the domain's current offline status, continuous monitoring for reactivation or domain resurgence under alternate names is recommended.