celestorasol[.]xyz

This domain, celestorasol.xyz, is under investigation for generic phishing activity. Registered on April 18, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, it currently resolves to a Cloudflare IP (172.67.216.148) located in Canada. Infrastructure analysis reveals Cloudflare nameservers (leo.ns.cloudflare.com, phoenix.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which are common among both legitimate and malicious sites. The domain appears on one security blocklist and was flagged in a single AlienVault OTX threat intelligence pulse, though no specific brand impersonation or phishing kit has been confirmed in available data. The page title 'Just a moment...' and HTTP 403 status suggest either a holding page, a blocked access attempt, or a misconfigured phishing landing page. Defenders should note that while 94 vendors scanned the domain on VirusTotal with no detections, this does not confirm safety—only that no known signatures matched at the time of scanning. The domain remains active and was recently blocked by PhishDestroy, indicating ongoing monitoring by at least one security provider. Given the lack of confirmed brand targeting or scam type, further analysis is required to determine the exact threat model. Recommended actions include monitoring DNS resolutions, inspecting SSL certificate transparency logs for related domains, and checking for connections to known phishing campaigns or shared infrastructure. If internal systems interact with this domain, log analysis should prioritize unusual outbound connections or credential submissions.