fernsystemsai[.]com

On July 24, 2026, the domain fernsystemsai.com was identified as a high‑risk brand‑impersonation site targeting the Celer brand. The site presents the page title “Fern Systems AI — Future‑Proof Your Business,” which does not reference Celer but is used as a lure. Registration data shows the domain was created on August 01, 2025 through NameCheap, Inc., and it is hosted on Amazon Web Services (ASN 16509) with the IPv4 address 99.83.231.61 located in the United States. DNS resolution uses the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com, and the domain serves a valid Let's Encrypt certificate (issuer E8), indicating encrypted HTTPS access that returns HTTP 200.

Email infrastructure is configured with Zoho mail exchangers (mx.zoho.com priority 10 and mx2.zoho.com priority 20), suggesting the operators may use legitimate mail services for credential harvesting or spam distribution. Threat‑intel aggregators have flagged the domain: six of ninety‑five VirusTotal scanners reported malicious behavior, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on two external blocklists. AlienVault OTX includes the domain in one pulse, and commercial blocklists such as PhishDestroy and ScamSniffer have already listed it as blocked, yet the site remains reachable. The evidence confirms active infrastructure but does not reveal the specific phishing kit or page content beyond the title, leaving the exact credential‑collection method uncertain.

Defenders should add fernsystemsai.com to DNS and URL filtering policies, monitor outbound connections to the associated AWS IP, and enforce TLS inspection to detect any credential submission. Continuous observation of the domain’s MX traffic and rapid removal from allow‑lists is advised, as the presence of legitimate mail hosts can obscure malicious activity.