cettus[.]zone

This domain is flagged for hosting a credential harvesting phishing portal, designed to deceive users into submitting sensitive login credentials. Analysis indicates a targeted campaign leveraging social engineering tactics to mimic legitimate authentication interfaces, posing an elevated risk to individuals and organizations. Infrastructure analysis reveals the domain cettus.zone was registered on June 17, 2025, through Dynadot LLC, a registrar frequently associated with newly created malicious domains. The domain resolves to the IP address 199.59.243.228, located in the United States under AS16509 (Amazon.com, Inc.). Security telemetry shows the domain appears on one blocklist, while VirusTotal reports 13 out of 95 security vendors flagging it as malicious. The absence of an SSL certificate further reduces trustworthiness, as modern phishing sites typically employ encryption to evade detection. The page title, matching the domain name, suggests a lack of effort to impersonate a specific brand, increasing the likelihood of a generic credential harvesting operation. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to cettus.zone, as phishing campaigns often distribute such domains via spam. End-users should be educated on recognizing generic login portals and verifying domain authenticity before entering credentials. Security teams are advised to monitor for credential reuse attempts, as harvested data may be exploited in follow-up attacks. Given the domain's recent creation and active status, proactive hunting for related infrastructure is recommended to identify and neutralize associated threats.