claim-plume[.]com

Analysis of claim-plume.com, observed as offline at the time of review, indicates a high‑risk brand impersonation campaign targeting Discord users. The domain was registered on August 08, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is protected by an SSL certificate identified as R10. VirusTotal records show that 10 of 95 security vendors have flagged the domain, suggesting malicious activity. The site appears on four security blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing the consensus that the infrastructure is malicious.

DNS resolution points to IP address 213.111.154.75, which is geolocated to the Netherlands and is associated with AS43641 SOLLUTIUM EU Sp z.o.o. The Gridinsoft trust score for the domain is 0 out of 100, indicating a lack of trustworthiness. The page title returned from the host is "Plume Airdrop," and the observed scam type is classified as social media phishing, specifically leveraging an Airdrop Scam kit. The campaign impersonates the Discord brand, likely attempting to harvest credentials or distribute malicious payloads under the guise of an airdrop offering.

While the site is currently offline, the underlying IP and hosting details remain active and may be reused for future campaigns. Defenders should continue to block the domain and associated IP address at network perimeters, update intrusion detection signatures to include the observed indicators, and monitor for any re‑registration attempts of the same second‑level domain. Additional telemetry should be collected on any residual DNS queries or TLS handshakes to detect resurgence of the infrastructure. Organizations using Discord should educate users about unsolicited airdrop messages and enforce multi‑factor authentication to mitigate credential compromise.