celer[.]sbs

The domain celer.sbs has been identified as a brand impersonation threat specifically targeting Binance, the well-known cryptocurrency exchange platform. This domain, which resolves to the IP address 104.21.22.121, was created on January 28, 2026, and presents itself with the page title "The Best Crypto & Binance Bridge | cBridge," a clear attempt to mimic legitimate Binance services. The threat type is brand impersonation, where the domain seeks to deceive users into believing they are interacting with an official Binance platform, potentially leading to credential theft or financial loss.

Technical indicators reveal a concerning profile for celer.sbs. VirusTotal analysis shows that 4 out of 95 security vendors flag this domain as malicious, indicating a moderate level of detection among security tools. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar sometimes associated with suspicious domains. It also appears on 3 security blocklists, suggesting prior recognition as a threat. The SSL certificate is identified as WE1, which may be a low-quality or self-signed certificate, further undermining its legitimacy. Notably, the domain is currently offline, but its historical presence and registration details remain risk factors.

The current status of celer.sbs is offline, meaning it is not actively serving content at the time of this report. This takedown is a positive outcome, likely resulting from reporting by security researchers or automated detection systems. However, the risk is not fully neutralized. The domain could be reactivated under the same or different IP, and the impersonation tactics used here could be replicated on other domains. Users should remain vigilant against any unsolicited communications referencing Binance or cBridge, verify URLs carefully, and avoid entering credentials or funds on unfamiliar sites. PhishDestroy recommends monitoring for similar domains and educating users about brand impersonation threats in the crypto space.