celestiafinance[.]com

The domain celestiafinance.com was flagged as a brand‑impersonation site targeting the blockchain project Celestia. Registration data shows the domain was created on 17 October 2025 through Dynadot LLC. DNS resolution points to the Amazon‑owned address 52.40.42.113 (AS16509, United States). The host presents an HTTPS certificate issued by Let’s Encrypt (R12) and serves HTTP 200 responses; the page title returned is “For Sale Page”. Server headers reveal Nginx with OpenResty and HTTP Strict Transport Security (HSTS) enabled.

The domain appears on a single security blocklist and is currently listed as offline by PhishDestroy. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 / 100. VirusTotal analysis shows four of ninety‑five scanners flagged the domain, confirming malicious intent. The authoritative nameservers are launch1.spaceship.net and launch2.spaceship.net.

For defenders, the immediate recommendation is to block the domain and its resolving IP at perimeter defenses, update URL filtering lists, and monitor the associated ASN for any new suspicious registrations. Additional measures include inspecting traffic to the nameserver domains, enforcing TLS inspection to capture any future content, and conducting periodic re‑scans of the IP address, as the hosting provider is a large cloud service that may be reused for other fraudulent activities. Continuous watch on new domains registered by the same registrar that contain the “celestia” keyword is also advised.