plasma[.]to-claims[.]app

This domain, plasma.to-claims.app, is confirmed to operate as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency assets from connected wallets. The site remains active and poses a high risk to users interacting with decentralized finance (DeFi) platforms. Analysis indicates the domain is not impersonating a specific legitimate brand but instead employs deceptive language related to institutional DeFi rewards to lure victims. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 18.222.140.9 and is protected by Cloudflare, a common tactic to obscure hosting details. Security vendors on VirusTotal flagged the domain at a rate of 13 out of 95, while it appears on four distinct security blocklists. The SSL certificate is issued by Google Trust Services, adding a superficial layer of legitimacy. The page title, 'Plasma Treasury Pool - Institutional DeFi Rewards,' is crafted to mimic legitimate reward programs, further enhancing its deceptive appearance. The domain remains active and continues to evade detection through dynamic infrastructure and obfuscation techniques. Users are advised to block all interactions with plasma.to-claims.app and associated IP addresses. Wallet providers and security platforms should update blocklists to include this domain and its resolving IP. Organizations should monitor for connections to 18.222.140.9 and alert users attempting to access the site. Given the high-risk nature of crypto drainers, immediate isolation of any compromised wallets and revocation of connected smart contract approvals is recommended.