plstoken[.]live

The domain plstoken.live was created on May 30, 2026 and is registered with NICENIC INTERNATIONAL GROUP CO., LIMITED. Its authoritative name servers are mckenzie.ns.cloudflare.com and seth.ns.cloudflare.com, indicating use of Cloudflare's DNS infrastructure. DNS resolution points to the IP address 64.29.17.1, which is hosted in the United States and belongs to Amazon.com, Inc. (AS16509). The site presented an HTTPS certificate issued by Let’s Encrypt under the YR2 profile, confirming that a valid TLS certificate was in place at the time of observation.

When accessed, the HTTP response returned status code 451, suggesting that the content was unavailable for legal reasons or was intentionally removed. The page title returned by the server was "PulseChain — Claim Your Rewards," aligning with a brand‑impersonation tactic that targets users of the PulseChain ecosystem. VirusTotal analysis recorded a single detection out of 91 security vendors, and the domain appears on one external blocklist. It has also been flagged and blocked by the PhishDestroy service.

Current operational status is offline, limiting immediate interaction, but the combination of a recent registration, Cloudflare DNS, Amazon hosting, a valid TLS certificate, and a brand‑related page title matches patterns commonly associated with credential‑harvesting phishing campaigns. Defenders should continue to monitor the domain for any re‑activation, add it to internal block lists, and consider updating web‑filter and email‑security policies to block URLs containing the "PulseChain" keyword when paired with the plstoken.live host. Because only a single vendor flagged the domain, the detection signal is modest, but the presence on a known phishing blocklist and the brand‑impersonation context warrant an elevated risk rating. Organizations should educate users about unsolicited reward claims related to PulseChain and enforce multi‑factor authentication to mitigate potential credential compromise.