plugins-runelite[.]net

The domain plugins-runelite.net was registered on 21 February 2026 and is presently listed as offline. Threat intelligence indicates the site was associated with a generic phishing campaign and was blocked by the PhishDestroy filtering service. The domain resolves to the IP address 172.67.141.254, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. An SSL certificate identified as type E1 was observed for the host, confirming that encrypted HTTPS was available while the site was active.

VirusTotal analysis recorded a single positive detection out of ninety‑three scanned antivirus and URL‑reputation engines, demonstrating that at least one scanning vendor flagged the domain as malicious. The Gridinsoft trust score assigned a rating of 0 out of 100, indicating an extremely low confidence in the site's safety. The domain appears on one public security blocklist, reinforcing the consensus that it should be treated as hostile.

Because the site is no longer reachable, active content cannot be examined, and the exact phishing landing page or targeted brand remain unverified. Nevertheless, the convergence of blocklist inclusion, low trust scoring, and the positive VirusTotal detection provides sufficient evidence for defenders to classify plugins-runelite.net as malicious. Recommended mitigation steps include adding the domain and its underlying IP address to network‑level block lists, ensuring that any previously cached credentials or cookies are purged, and monitoring for future registrations of similar lexical patterns that may be used in follow‑up campaigns.