equinor-vn[.]com

Analysis of equinor-vn.com indicates that the domain is being used for a brand‑impersonation campaign targeting the celer brand. The domain was registered on 30 November 2025 through Dominet (HK) Limited and resolves to the IP address 188.114.96.3, which is part of the Cloudflare network (AS13335) located in the United States. No SSL certificate is presented, meaning the site is served over plain HTTP. The authoritative nameservers are ishaan.ns.cloudflare.com and meilani.ns.cloudflare.com, confirming Cloudflare hosting. Reputation services assign extremely low trust scores: Gridinsoft 0/100 and Scamadviser 1/100.

The page title returned by the server is “Equinor”, which does not correspond to the advertised target brand, but the intelligence explicitly tags the domain as impersonating celer. The domain appears on two public blocklists and has been flagged by PhishDestroy and ScamSniffer. In the Open Threat Exchange, the domain appears in three separate threat‑intel pulses, reinforcing its malicious classification. VirusTotal analysis shows that seven of ninety‑three scanned security vendors flagged the domain, providing additional corroboration. The site is currently taken offline, which may be the result of takedown actions or hosting changes.

At present, no further content has been captured, so the exact phishing landing page layout and credential‑capture mechanisms remain unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or resurrection of the host, and consider adding the associated IP address 188.114.96.3 to deny‑list rules. Ongoing observation of the two Cloudflare nameservers is advisable, as future malicious infrastructure may reuse them. The combination of low trust scores, blocklist presence, multiple vendor detections, and OTX pulse references supports an elevated risk rating for this domain.