cabinet[.]fortbiit[.]com

The domain cabinet.fortbiit.com has been identified as a brand impersonation threat targeting Celer, a recognized entity in the financial or blockchain sector. Analysis confirms the domain was actively mimicking Celer’s branding, as evidenced by the page title "Fortbit | Stocks Trading and Portfolio Management," which aligns with typical impersonation tactics used to deceive users into engaging with fraudulent financial services. The domain is currently offline, but prior activity suggests it was designed to exploit trust in the targeted brand for malicious purposes. Infrastructure analysis reveals multiple high-risk indicators. The domain was flagged by 4 of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. It was registered on June 16, 2025, through Cosmotown, Inc., a registrar frequently associated with high-risk domains. The domain resolved to the IP address 163.61.188.2 and was detected on one security blocklist, further corroborating its suspicious classification. Additional technical indicators include the use of LiteSpeed, Smartsupp, jQuery, GetButton, and HTTP/3, which are not inherently malicious but are commonly observed in impersonation campaigns. The Gridinsoft trust score of 0/100 underscores the domain’s lack of credibility. Current status confirms the domain has been taken offline, mitigating immediate user exposure. However, organizations and users should remain vigilant, as threat actors may re-establish similar infrastructure under different domains. It is recommended to monitor for newly registered domains associated with the same registrar or IP range, particularly those mimicking financial or blockchain brands. Network-level protections should be updated to block known malicious IPs and domains, and users should be educated on recognizing brand impersonation tactics, such as verifying domain registration details and scrutinizing page titles for inconsistencies with legitimate services.