plasma[.]mom

Analysis of the domain plasma.mom indicates that it is a brand impersonation threat specifically targeting Bitfinex. The domain is designed to deceive users into believing they are interacting with legitimate Bitfinex services, potentially leading to credential theft or financial loss. No evidence of a drainer kit was found during the initial investigation.

Infrastructure analysis reveals that plasma.mom has a VirusTotal detection score of 14/95, indicating a moderate level of suspicion among security vendors. The domain is registered through Porkbun LLC and resolves to the IP address 2606:4700:10::ac42:9c31, which is located in the United States and associated with AS13335 Cloudflare, Inc. The domain was created on September 24, 2025, and is currently listed on 1 security blocklist. The page title 'Plasma - Stablecoin infrastructure for instant payments' further suggests an attempt to mimic Bitfinex's branding and services.

The current status of the domain is offline, as it has been taken down. However, the risk remains elevated due to the potential for reactivation or similar domains being registered. Users are advised to remain vigilant and double-check URLs before entering sensitive information. Security teams should monitor for related infrastructure and ensure that protective measures are in place to prevent future impersonation attempts.