plasmacheck[.]xyz

plasmacheck.xyz was registered on 29 September 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. The domain resolves to that IP and is served without an SSL certificate, indicating HTTP‑only access. DNS resolution points to the Cloudflare authoritative name servers sima.ns.cloudflare.com and tosana.ns.cloudflare.com. The site presented the page title “Um momento…”, but no further content has been captured.

Analysis of the page indicates the use of an Airdrop Scam phishing kit, a known template employed to lure victims with promises of cryptocurrency airdrops. VirusTotal scans show that five of ninety‑five security vendors flagged the domain as malicious, confirming a consensus of moderate detection across the scanning community. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Current network checks confirm that the domain is offline as of the report date, July 24 2026, and no active HTTPS service is observed.

Uncertainty remains regarding the specific victim targeting, payload delivery mechanisms, and whether additional infrastructure components such as command‑and‑control servers are associated with the domain, as no further indicators such as URLs, hashes, or email samples have been disclosed. Defenders should add 188.114.96.3 to network block lists, enforce DNS filtering for plasmacheck.xyz, and monitor Cloudflare‑hosted IP ranges for similar Airdrop Scam activity. Continued observation of the domain’s registration and any re‑activation attempts is recommended, as well as sharing any newly discovered artifacts with threat‑intel sharing platforms.