celestara-game[.]app

Analysis on the domain celestara-game.app, first observed on May 28 2026, indicates it is being used for a generic phishing operation. The domain resolves to the IP address 172.67.133.54, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Registration records show the domain was created on May 28 2026 through the registrar Devexpanse Ltd. The authoritative nameservers are jaziel.ns.cloudflare.com and michelle.ns.cloudflare.com, both hosted by Cloudflare. No TLS certificate was found for the host, meaning the service is accessible only over plaintext HTTP, which is consistent with many low‑cost phishing deployments.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal scans have identified the domain as suspicious in 2 of 91 security vendor engines, and the domain appears on a single external blocklist. Additionally, the phishing‑focused blocklist PhishDestroy has listed the domain, confirming that at least one dedicated anti‑phishing service has taken it down. The current operational status is reported as offline, suggesting that the hosting provider or the attacker has removed the site, but the infrastructure footprint remains observable.

Defenders should continue to block traffic to both the domain and its associated Cloudflare IP, monitor for any re‑registration of the domain or creation of similar domains under the same registrar, and consider adding the IP address to network‑level deny lists. Because the domain uses Cloudflare’s shared infrastructure, related sub‑domains may be spun up quickly; threat‑intel feeds should be queried for new entries referencing the same registrar or nameservers. Continuous re‑scanning with multi‑vendor engines is recommended to capture any future changes in detection status.