plumecore[.]org

Analysis of plumecore.org indicates that the domain was actively used for a generic phishing campaign before being taken offline. The site was registered on August 11, 2025 through NameSilo, LLC and resolved to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The SSL certificate presented the identifier “WE1”, suggesting a self‑signed or low‑trust certificate. The page title returned by HTTP requests was “Nur einen Moment…”, a German phrase meaning “Just a moment…”, which is commonly employed to delay users while malicious scripts load.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal recorded a single positive detection out of 93 scanned vendors, confirming that at least one security product identified malicious behavior. PhishDestroy also listed the domain as blocked. Current status shows the domain is offline, preventing direct interaction, but the historical footprint remains relevant for threat‑intelligence feeds.

Uncertainty remains regarding the specific phishing kit or targeted brand, as the page title does not disclose a victim name and no additional content analysis is available. Defenders should continue to block traffic to 188.114.97.3 for the duration of its use, add plumecore.org to internal watchlists, monitor for any re‑registration of the same name or similar patterns, and correlate any future alerts with the observed indicators such as the Cloudflare ASN, the “WE1” certificate label, and the German page title. Ongoing vigilance is recommended to prevent reuse of the infrastructure for new campaigns.