test[.]celestiasecurity[.]com

PhishDestroy has confirmed that test.celestiasecurity.com is a brand impersonation phishing site, specifically targeting the cybersecurity firm Celestia. The domain is currently offline, having been taken down after its malicious activities were identified. It was registered through Cloudflare, Inc. and resolved to IP address 135.235.16.114, with an SSL certificate issued by Let's Encrypt (R12). The domain was created on January 16, 2023, and its page title, "Celestial Security – Cyber Security Solutions," was designed to mimic the legitimate Celestia brand.

Technical analysis reveals that the domain appears on two security blocklists and is flagged by 2 out of 95 VirusTotal security vendors, indicating a low but concerning detection rate. The use of Cloudflare as a registrar and Let's Encrypt for SSL is common among phishing sites, as these services are easily accessible and provide a veneer of legitimacy. The site's brand impersonation of Celestia suggests an attempt to deceive visitors into believing they are on an official Celestia portal, potentially for credential theft or malware distribution.

Given that the domain has already been taken offline, the immediate risk is mitigated. However, users should remain vigilant for similar domains that may appear under the Celestia brand. PhishDestroy recommends that organizations monitor for lookalike domains and educate employees about the risks of brand impersonation. For individuals, avoid clicking on links from unsolicited communications and verify URLs before entering sensitive information. If any suspicious activity is observed, report it to the relevant security team or use a threat intelligence platform for further analysis.