celsiusdistribution[.]tellancollections[.]co[.]ke

Analysis conducted on July 25, 2026 identifies the domain celsiusdistribution.tellancollections.co.ke as a confirmed generic phishing infrastructure that has been taken offline. The domain was registered on February 21, 2026 and resolves to the IPv4 address 84.16.251.118, which is hosted in Germany under Autonomous System AS28753 owned by Leaseweb Deutschland GmbH. An SSL certificate with the internal identifier R10 is present, indicating that TLS was provisioned for the site.

The page title returned by the server is "Celsius Network LLC, et al.", which aligns with the target brand referenced in the phishing campaign. VirusTotal scans show that three out of ninety‑three security vendors flagged the domain, providing independent confirmation of malicious intent. The domain appears on two public blocklists and is actively blocked by the PhishDestroy and ScamSniffer filtering services.

No additional intelligence such as Safe Browsing, OTX, or further host‑level observations is available at this time. Defenders should continue to block the domain at network perimeter devices, update any URL filtering or DNS sinkhole policies, and monitor for reuse of the underlying IP address or similar SSL certificate fingerprints. Because the site is currently offline, threat actors may redeploy the same infrastructure under a new domain; ongoing vigilance on Leaseweb‑hosted IP ranges and rapid re‑evaluation of newly observed domains that resolve to 84.16.251.118 are recommended.