pool-plasma[.]to

The domain pool-plasma.to is a generic phishing site targeting cryptocurrency users. It does not impersonate a specific brand but operates as a cryptocurrency scam, likely designed to trick victims into revealing wallet credentials or transferring funds. As of the latest verification, pool-plasma.to has been taken offline, though prior activity classified it as an elevated-risk threat.

Technical indicators confirm the malicious nature of pool-plasma.to. The domain was flagged by 2 of 95 security vendors on VirusTotal, including CRDF and Gridinsoft, which assigned it a trust score of 0/100. It appears on two security blocklists, PhishDestroy and ScamSniffer, though Google Safe Browsing did not flag it. Registered through NAMECHEAP on July 11, 2025, the domain resolved to the IP address 23.111.160.242, hosted in the US under AS29802 (HIVELOCITY, Inc.). The SSL certificate was issued by R10, and the observed page title was 'Plasma'. At the time of analysis, the site returned an HTTP 429 status code.

Users who interacted with pool-plasma.to should assume their cryptocurrency wallet credentials may be compromised. Immediate steps include revoking any token approvals granted to unknown contracts, transferring remaining funds to a new wallet, and monitoring transaction history for unauthorized activity. Victims should also report the domain to their wallet provider and relevant fraud reporting platforms, such as the FBI’s Internet Crime Complaint Center (IC3) or local cybercrime authorities. Enabling two-factor authentication on all financial and crypto-related accounts adds an additional layer of security.