user[.]plnminv[.]net

This domain, user.plnminv.net, is flagged as a cryptocurrency phishing site targeting users of Plenum Investments AG, a financial services brand. Analysis indicates the domain was designed to mimic legitimate investment platforms, likely to harvest credentials or facilitate unauthorized transactions. No specific drainer kit signatures were identified, but the infrastructure aligns with known phishing campaigns targeting cryptocurrency wallets and investment portals. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 08, 2026. Detection metrics show 3 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on three independent security blocklists. The domain holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than benign status. The domain has been taken offline, reducing immediate exposure risk. However, historical DNS records and SSL certificates issued by Let's Encrypt suggest prior active exploitation. Users who interacted with the domain should revoke any associated credentials, monitor financial accounts for unauthorized activity, and verify wallet addresses before executing transactions. The registrar's response remains unconfirmed, leaving potential for re-registration under similar naming conventions. Continued vigilance is advised for domains mimicking financial institutions, particularly those with recent creation dates and low detection counts.