plasmalabs[.]us

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

Analysis indicates that the domain plasmalabs.us is actively serving web content over HTTPS with a valid GoDaddy DV certificate. The site resolves to the IPv4 address 13.248.213.45, which is hosted in the AWS Global Accelerator network in the United States (California). The domain was registered on 30 April 2026, and an HTTP GET request returns a 200 status code, confirming that the hosting infrastructure is operational. VirusTotal scans have identified the domain as malicious in three out of ninety‑five vendor engines, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of abuse. AlienVault OTX records the domain in eight distinct threat‑intel pulses, and it appears on three public blocklists. The domain is currently blocked by multiple sink‑hole services, including PhishDestroy, MetaMask, and SEAL, reinforcing the view that it is being used for fraudulent activity. The specific brand or service being spoofed by plasmalabs.us has not been disclosed in the available intelligence, leaving the precise lure unknown. However, the generic phishing classification, combined with the rapid registration date and the use of a reputable TLS certificate, matches a pattern observed in recent phishing campaigns that leverage newly registered domains to gain user trust. Defenders should add 13.248.213.45 and plasmalabs.us to deny‑list configurations, enforce strict URL filtering, and monitor for TLS handshakes that present the GoDaddy DV certificate chain. Network traffic to the AWS Global Accelerator edge should be logged, and any credential submission attempts to the domain should be flagged for investigation. Continuous threat‑intel feeds should be consulted for updates on associated payloads or compromised accounts linked to this infrastructure.