registration[.]plums[.]network

PhishDestroy identifies plums.network as an active credential-stealing operation targeting users with a spoofed login form. The site masquerades as a legitimate service while harvesting entered usernames and passwords, exposing victims to immediate account takeovers and financial fraud.

This domain was flagged by VirusTotal on 1 of 95 security vendors, confirming its maliciousness. It was registered with an SSL certificate issued by Let’s Encrypt, indicating an attempt to appear trustworthy, and resolves to IP address 104.21.89.120. While the registrar and creation date remain undisclosed, the low detection rate highlights how new or lightly abused domains often evade early detection.

If you visited plums.network, assume your credentials were compromised. Immediately change passwords on all accounts using the same login details and enable multi-factor authentication where possible. Scan your devices for malware using a reputable antivirus tool, monitor financial accounts for unauthorized activity, and report any suspicious transactions to your bank. Do not reuse passwords across different services to prevent further exposure.