pool-plasma[.]to

pool-plasma.to entered the PhishDestroy evidence set on Feb 26, 2026. The stored content classification is crypto drainer. The assembled evidence scores 63/100 (elevated).

Two independent sources are positive: VirusTotal and ScamSniffer. VirusTotal recorded 2 detections among 93 engines: CRDF, Gridinsoft on Jul 18, 2026 at 18:45 UTC. ScamSniffer listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 14:20 UTC. The evidence is not unanimous. URLQuery recorded no positive detection on Jul 12, 2025 at 23:39 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 13, 2026 at 08:13 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:22 UTC; content was unavailable. Registration records for the domain list NAMECHEAP as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 23.111.160.242 on AS29802 (HVC-AS, US). The associated network metadata labels the endpoint as AS29802 HIVELOCITY, Inc. in Tampa, US. The stored server header is LiteSpeed. Captured page title: “Plasma”. DOM analysis completed on Mar 23, 2026 at 23:16 UTC; stored DOM score 5/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction completed on Aug 2, 2026 at 04:04 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists R10 as the certificate issuer.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as crypto drainer.