plumme-registers[.]xyz

plumme-registers.xyz is currently offline but remains a high‑confidence indicator of a crypto‑focused brand‑impersonation campaign targeting Metamask users. The site presented a page titled “Connect Wallet UI”, a phrasing commonly used to lure victims into authorising wallet connections. Registration data shows the domain was created on 21 February 2026, indicating a recent establishment. DNS resolution points to the IPv6 address 2606:4700:3034::6815:370e, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The SSL certificate presented is identified as “WE1”, confirming that TLS was active at the time of capture.

Multiple defensive feeds have flagged the domain: AlienVault OTX includes it in 13 distinct threat‑intel pulses, and it appears on two independent security blocklists. Commercial scanning services reported that 13 of 95 antivirus engines on VirusTotal flagged the domain as malicious. Reputation services assign extremely low confidence scores, with Gridinsoft rating it 0 / 100 and Scamadviser 1 / 100. The domain has been blocked by the PhishDestroy and ScamSniffer filtering platforms. Given the convergence of brand‑impersonation cues, low trust scores, and multi‑vendor detections, defenders should treat plumme-registers.xyz as a confirmed malicious indicator.

Recommended mitigation steps include adding the domain and its resolving IP address to network deny lists, updating URL filtering policies to block any HTTP(S) requests matching the domain, and extending detection rules to cover similar “Connect Wallet UI” page titles. Continuous monitoring of newly registered domains that resolve to Cloudflare‑owned IPv6 ranges and that reference Metamask in their content is advised, as threat actors frequently recycle infrastructure.