cielglow[.]shop

The domain cielglow.shop was observed on a single security blocklist and is currently listed as active under investigation. Infrastructure analysis shows the domain is delegated to Cloudflare nameservers penny.ns.cloudflare.com and scott.ns.cloudflare.com, and resolves to the IP address 188.114.96.3. The domain has been explicitly blocked by the PhishDestroy feed, indicating that at least one reputable phishing‑tracking service has taken action against it.

A recent VirusTotal scan recorded submissions from 95 antivirus and URL‑reputation engines; none of the engines generated a detection. The report explicitly notes that the lack of detections does not constitute evidence of benign behavior, only that the payload has not yet been identified by those scanners. No additional public intelligence such as Safe Browsing alerts, OTX mentions, or SSL certificate details are available at this time.

Because the only concrete indicators are the blocklist entry, the Cloudflare name server configuration, and the resolved IP address, defenders should prioritize network‑level mitigation: add cielglow.shop and its resolving IP 188.114.96.3 to DNS and web‑proxy deny lists, monitor DNS queries for the domain, and consider feeding the indicator into internal threat‑intel platforms. Continuous re‑evaluation is advised, as further telemetry may reveal malicious payloads or additional hosting changes that could increase the risk profile.