n8n[.]celestiasecurity[.]com

Analysis of the domain n8n.celestiasecurity.com indicates a brand impersonation campaign targeting Celestia, a blockchain infrastructure provider. The domain was registered on February 28, 2026, through Cloudflare, Inc., and is currently offline with an HTTP 404 status. Infrastructure analysis reveals the domain resolves to the IP address 135.235.16.114, hosted on AS8075 (Microsoft Corporation) in India. Nameservers lewis.ns.cloudflare.com and melissa.ns.cloudflare.com further confirm Cloudflare as the DNS provider. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains.

Detection data shows the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. VirusTotal reports flagging by 3 of 93 security vendors, though the specific detection rules are not detailed in available intelligence. The page title, 'n8n.io - Workflow Automation,' suggests an attempt to mimic n8n.io, an open-source workflow automation platform, aligning with the observed brand impersonation targeting Celestia.

The combination of a recently registered domain, low trust scores, blocklist presence, and impersonation of a workflow automation tool associated with a blockchain project indicates elevated risk. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. While the domain is currently offline, monitoring for reactivation or related infrastructure shifts is recommended. No evidence confirms the exact payload or attack vector, but the alignment with Celestia's ecosystem suggests potential credential harvesting or fraudulent token distribution as plausible objectives.