vision-celexa-pip[.]com

vision-celexa-pip.com was observed for the first time on February 21 2026 when the WHOIS record was created by Name SRS AB. The domain resolves to the Cloudflare edge address 104.21.32.182, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative name servers leland.ns.cloudflare.com and olivia.ns.cloudflare.com. No TLS certificate is presented, indicating the site was served over plain HTTP at the time of capture. The only visible HTTP response contained the title “Suspected phishing site | Cloudflare”, which suggests the page was either taken down by Cloudflare or flagged as malicious by the provider. Threat‑intelligence aggregators have begun to surface the domain.

VirusTotal reports that one of ninety‑three scanning engines flagged the domain, confirming the presence of at least one detection. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has listed the site as blocked, and AlienVault OTX includes it in one pulse, reinforcing the classification as a phishing‑related indicator. The overall risk rating assigned by the reporting system is elevated, and the current operational status is offline. While the limited data confirm that the domain is being used for phishing, the exact target brand, payload, or credential‑harvesting mechanism has not been disclosed.

No further artefacts such as malicious scripts, redirect chains, or compromised accounts have been observed. Consequently, the precise campaign scope and victim profile remain uncertain. Defenders should add 104.21.32.182 to network‑level deny lists, enforce DNS filtering for vision-celexa-pip.com, and monitor for any future resolution changes that might point to a different hosting provider. Continuous re‑query of VirusTotal, OTX, and public blocklists is recommended to capture additional detections.