celsols[.]com

celsols.com was registered through PublicDomainRegistry.com (operating as PDR Ltd.) on 19 August 2025. The domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The site is currently taken offline; the last observed HTTP response returned the generic page title “Just a moment…”. The TLS certificate presented on the host is identified only as “WE1”, indicating a non‑standard or self‑issued certificate that does not provide additional trust signals. Reputation checks show a Gridinsoft trust score of 0 / 100, and a single antivirus engine out of 93 on VirusTotal flagged the domain as malicious.

The domain is listed on at least one public phishing blocklist and is actively blocked by the PhishDestroy service. The intelligence categorises the activity as a crypto‑related scam, although no further details about the payload or victim interaction have been published. Analysis of the available infrastructure suggests the operators deliberately leveraged Cloudflare’s CDN to obscure the true origin of the malicious host, a common tactic for short‑lived phishing campaigns. The lack of a substantive page title and the use of a placeholder certificate further point to a rapid deployment intended to capture traffic before takedown.

Because the site is already offline, immediate threat mitigation focuses on preventing future re‑use of the same registration or hosting assets. Defensive teams should add 188.114.96.3 to network‑level blocklists, enforce DNS filtering for celsols.com, and monitor for re‑registration of the domain or similar domains registered through the same registrar. Continuous monitoring of VirusTotal, PhishDestroy, and other phishing feed providers is recommended to capture any resurgence. Until more detailed payload samples become available, the confidence level remains elevated due to the combination of low trust score, vendor detection, and blocklist inclusion.