docs-celestia-media-net[.]pages[.]dev

On 24 July 2026 the domain docs-celestia-media-net.pages.dev was observed being taken offline after detection by the PhishDestroy blocklist. The domain was registered through Cloudflare on 21 February 2026 and resolves to the Cloudflare address 172.66.44.124, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. DNS resolution uses the Cloudflare authoritative name servers fay.ns.cloudflare.com and darwin.ns.cloudflare.com. HTTPS is served with a Google Trust Services certificate (WE1) and the site enforces HSTS while supporting HTTP/3, indicating a modern Cloudflare edge configuration.

An HTTP request returns status code 403 and the page title reported by the scanner is “Suspected phishing site | Cloudflare”, consistent with a Cloudflare block page. The domain is flagged as a brand‑impersonation of Celestia; no additional content was captured before the takedown, so the exact nature of the fraudulent page remains unknown. Reputation data shows the domain appears on a single security blocklist and three of ninety‑three VirusTotal scanners flagged it as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification.

Because the infrastructure is hosted entirely on Cloudflare, threat actors can rapidly generate similar pages using new subdomains under the *.pages.dev namespace. Defenders should immediately block 172.66.44.124 and the domain name in network perimeter filters, add the domain to internal URL blocklists, and monitor for future registrations that reuse the “docs‑celestia‑media‑net” pattern or reference the Celestia brand. Continuous observation of Cloudflare‑hosted pages.dev zones is advised to catch rapid re‑deployment attempts.