plasma-domains[.]gitbook[.]io

The domain plasma-domains.gitbook.io was an active phishing site engaged in brand impersonation targeting Google. It presented itself as a legitimate Google service to deceive users into providing sensitive information, specifically through a tech-support scam. No crypto drainer kit was detected. The site has since been taken offline, but its prior activity poses an elevated risk to those who may have interacted with it.

Technical indicators confirm the malicious nature of plasma-domains.gitbook.io. The domain was flagged by 3 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and Gridinsoft, which assigned it a trust score of 0/100. It appeared on one security blocklist, PhishDestroy, though Google Safe Browsing did not flag it. Registered through Cloudflare, Inc. on March 30, 2014, the domain resolved to the IP address 104.18.41.89, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Join GitBook - GitBook'. Technologies detected on the site included GitBook, Google Cloud, React, and various analytics tools.

Users who visited plasma-domains.gitbook.io should take immediate safety steps. Since the threat involved credential phishing, affected individuals should change passwords for any accounts accessed or entered on the site and enable two-factor authentication where available. Monitor accounts for unauthorized activity and report any suspected fraud to the impersonated brand, Google. Additionally, victims can report the phishing domain to their email provider, browser vendor, or platforms like the Anti-Phishing Working Group (APWG) or Google Safe Browsing.