bcmontipt[.]sbs

This domain, bcmontipt.sbs, is identified as a brand impersonation threat specifically targeting Celer Network, a blockchain interoperability protocol. The site mimics legitimate Celer infrastructure, potentially tricking users into disclosing sensitive credentials, wallet keys, or authorizing fraudulent transactions under the guise of official Celer services. The page title 'Full Gallery' suggests an attempt to appear as a legitimate gallery or portal, though no legitimate Celer service uses this nomenclature, reinforcing the likelihood of malicious intent. Analysis indicates that bcmontipt.sbs was registered on February 21, 2026, an unusually forward-dated creation that may indicate domain spoofing or registrar manipulation. The domain resolves to IP address 196.251.100.147, located in Seychelles (SC), a jurisdiction frequently associated with anonymized hosting. As of the latest scan, 19 out of 95 security vendors on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on one security blocklist and is blocked by at least one anti-phishing engine. The SSL certificate is classified as R13, a low-assurance certificate type often used in short-lived phishing campaigns. Users who have visited bcmontipt.sbs should immediately revoke any active sessions or authorizations linked to Celer or blockchain services. If credentials or private keys were entered, users must transfer assets to a new wallet and monitor all connected accounts for unauthorized activity. Browser caches and saved passwords should be cleared to prevent persistent access. Network administrators are advised to block the domain and associated IP (196.251.100.147) at the perimeter to prevent further exposure. Given the domain's current offline status, continued monitoring of related infrastructure is recommended, as threat actors may re-deploy similar domains using the same seed pattern (e9d03e).