usdc-plume-bridge[.]pages[.]dev

PhishDestroy identifies usdc-plume-bridge.pages.dev as an active crypto drainer campaign impersonating Plume Finance, a decentralized finance (DeFi) protocol specializing in USDC liquidity solutions. The malicious domain masquerades as the official Plume Finance bridge to siphon user funds via deceptive smart contract interactions. Current telemetry confirms the infrastructure remains live and operational, posing a direct threat to cryptocurrency users engaging with DeFi platforms.

This domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.44.178, which is associated with Cloudflare’s infrastructure. The SSL certificate, issued by Google Trust Services LLC, shows a valid trust path but does not mitigate the malicious intent. VirusTotal analysis indicates 0 vendors flagged the URL out of 95, underscoring the need for proactive threat hunting given the domain’s recent operational status. The infrastructure’s freshness and low detection rate suggest a targeted, possibly evasive campaign designed to exploit trust in legitimate-looking DeFi interfaces.

Given the active status and low detection coverage, PhishDestroy recommends immediate network-level blocking of both the domain and its resolved IP address (172.66.44.178) to prevent user exposure. Users are advised to verify all DeFi-related URLs through official channels and cross-check domain certificates against known legitimate endpoints. Report this domain to your security stack and threat intelligence platforms to enhance collective defense. Exercise heightened scrutiny when interacting with USDC liquidity or bridging platforms, prioritizing official documentation and community-verified sources to avoid exploitation.