register-plasma[.]to

The domain register-plasma.to was registered through Namecheap on 21 February 2026 and is currently taken offline. DNS resolution points to the IPv4 address 23.111.160.242, which belongs to the AS29802 HIVELOCITY, Inc. network located in the United States. The authoritative name servers are dns101.registrar-servers.com and dns102.registrar-servers.com, both typical of the registrar’s default configuration. When the site was reachable it returned HTTP 200 and presented a page titled “Plasma”, but no additional content has been captured.

SSL analysis reports a certificate labeled “R10”, indicating an atypical or self‑issued certificate without a trusted chain. Reputation checks show the domain appears on two public blocklists and is actively blocked by PhishDestroy and ScamSniffer. VirusTotal scanned the site and six of ninety‑five security vendors flagged it as malicious, while Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high likelihood of abuse. The observed activity aligns with a wallet/seed phishing campaign, suggesting the site was used to harvest cryptocurrency wallet recovery phrases.

Current evidence does not reveal the specific phishing kit or any post‑compromise infrastructure, and the offline status prevents further payload collection. Defenders should add 23.111.160.242 and the domain register‑plasma.to to network‑level deny lists, monitor Namecheap registrations for similar short‑lived domains, and consider sinkholing the associated IP range. Continuous re‑evaluation is advised in case the operator re‑hosts the campaign on a new host or modifies the TLS certificate.