proposals-plasma[.]app

The domain proposals-plasma.app was a phishing site engaged in brand impersonation targeting users of the Across protocol. It presented itself as a legitimate Plasma chain portal, using the page title 'Plasma - A high-throughput, EVM-compatible stablecoin chain' to deceive visitors into connecting wallets, which could lead to unauthorized transactions or fund theft. No drainer kit was identified, but the site operated as a wallet-connect phishing scam. proposals-plasma.app is currently taken offline, reducing immediate risk to users.

Technical indicators confirm the malicious nature of proposals-plasma.app. The domain was flagged by 1 of 95 VirusTotal security vendors, specifically Fortinet, and appeared on 1 security blocklist (PhishDestroy). It was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolved to the IP address 172.67.162.172, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate was issued by Google Trust Services / WE1, and the nameservers were evan.ns.cloudflare.com and sydney.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100, and the site returned an HTTP 429 status code at the time of analysis.

Users who interacted with proposals-plasma.app should immediately revoke any token approvals granted to the site and transfer funds to a new wallet to prevent potential theft. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the phishing domain to the impersonated brand, Across, and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.