plume[.]stakingsrewards[.]club

This report details the technical analysis of the domain plume.stakingsrewards.club, which posed a significant security threat. The site's page title was "Google," and it was specifically designed to impersonate the brand "gmail" as part of an email-based scam. The primary threat was credential harvesting, where unsuspecting users would be tricked into entering their login details on a fraudulent interface mimicking a legitimate email service.

Technical evidence confirms the site's malicious nature. VirusTotal analysis shows 16 out of 95 security vendors flagged the domain as malicious. The domain was registered on 2026-02-21 and hosted on IP address 142.250.186.100, located in Germany and belonging to AS15169 Google LLC. The SSL certificate was identified as "WE2." The site was flagged by multiple security vendors including ADMINUSLabs, ChainPatrol, BitDefender, CRDF, and CyRadar, and was listed on one blocklist. The GridinSoft trust rating is 0 out of 100, and the DOM risk score is 73.

The domain plume.stakingsrewards.club is currently reported as DOWN/OFFLINE. Despite being non-operational, the high DOM risk score of 73 and the zero trust rating indicate it was a very dangerous site. Its risk level remains elevated due to the potential for reactivation or the existence of similar domains under the same threat actor, posing a continued risk to users who may encounter it.