medilabtec[.]com

This domain, medilabtec.com, poses a significant threat as a brand impersonation phishing site specifically targeting users of the Celer platform. The site was designed to mimic legitimate Celer services, likely to harvest credentials, financial details, or other sensitive information from unsuspecting visitors. Brand impersonation attacks like this are particularly effective because they exploit trust in well-known names, increasing the likelihood of successful deception. Analysis indicates medilabtec.com was created on August 8, 2020, and registered through Tucows Domains Inc. The domain resolved to the IP address 197.242.144.23, located in South Africa under AS37611 (AFRIHOST SP (PTY) LTD). At the time of detection, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, with Google Safe Browsing specifically classifying it as phishing. The site appeared on at least one security blocklist and was blocked by PhishDestroy. The SSL certificate was issued by Let's Encrypt (R13), a common tactic among phishing operators to lend a false sense of legitimacy to fraudulent sites. If you visited medilabtec.com or entered any information on the site, immediate action is required. First, disconnect the affected device from the network to prevent potential data exfiltration. Run a full antivirus scan to detect and remove any malware that may have been installed. Change passwords for all accounts accessed from the compromised device, prioritizing financial, email, and Celer-related accounts. Enable multi-factor authentication where available to add an extra layer of security. Monitor accounts for unauthorized transactions or suspicious activity and report any findings to the appropriate financial institutions or service providers. If credentials were entered, assume they are compromised and avoid reusing them across other platforms.