celia-finance[.]pages[.]dev

On 25 July 2026, the domain celia-finance.pages.dev was observed as an offline infrastructure linked to a brand-impersonation campaign targeting Lido. The site returned HTTP 403 and presented the page title “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s protective page is being served. Registration data shows the domain was created on 10 September 2024 through Cloudflare, Inc., and the authoritative nameservers are jessica.ns.cloudflare.com and ken.ns.cloudflare.com. DNS resolution points to 172.66.45.45, an address allocated to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the “WE1” label, confirming the use of a legitimate certificate chain.

Security-vendor scans on VirusTotal recorded a single positive detection out of 93 scanners, and the domain appears on one external blocklist. Independent reputation services have assigned a Gridinsoft trust score of 0 / 100, and the domain has been blocked by the PhishDestroy feed. Detected technologies include HTTP/3, HSTS enforcement, and the Cloudflare front-end. The risk rating is elevated, and the current operational status is taken offline, suggesting the operator may be attempting to evade further takedown actions.

Uncertainty remains regarding the exact phishing kit or content that was served before the takedown, as no visual or functional analysis is available. Defenders should continue to monitor DNS queries for the IP address 172.66.45.45 and the associated Cloudflare nameservers, add the domain and its IP to internal blocklists, and incorporate the single VirusTotal detection into automated threat-intel feeds. Because the domain is hosted on a shared Cloudflare network, collateral impact on other tenants is unlikely, but vigilance is advised for any future subdomains that resolve to the same IP range.