plumeair[.]eth[.]limo

PhishDestroy identifies plumeair.eth.limo as an active phishing site impersonating an Ethereum wallet login portal, leveraging a classic drainer kit designed to harvest private keys and seed phrases from unsuspecting cryptocurrency users.

This domain resolves to IP 3.135.72.151 and is secured with a Let’s Encrypt SSL certificate, lending it an air of legitimacy. VirusTotal currently reports 13/95 detections from major antivirus engines, indicating it has flown under the radar since its deployment. The domain was registered recently and is served via a cloud hosting provider, while Google Safe Browsing (GSB) has not yet flagged it. Blocklist aggregators show zero detections to date, underscoring the need for proactive monitoring.

As the investigation remains active, plumeair.eth.limo continues to serve its malicious content. Immediate takedown or network-based blocking is recommended to prevent further victimization. Despite the absence of detections at this time, the domain’s infrastructure and certificate issuance suggest operational maturity by threat actors. Remaining risk is moderate due to its active status and lack of universal detection, necessitating rapid containment and user awareness campaigns targeting cryptocurrency holders.