purechallenger[.]world

Analysis indicates that the domain purechallenger.world was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served from the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site resolves to Cloudflare nameservers vick.ns.cloudflare.com and khloe.ns.cloudflare.com, and presents a TLS certificate issued by Google Trust Services under the WE1 label. When accessed, the HTTP response returned a 403 status code and the page title displayed "Suspected phishing site | Cloudflare," suggesting that the content was flagged by Cloudflare’s automated phishing protection. Technical fingerprinting reveals a stack comprising Node.js, React, Next.js, Webpack and HTTP/3, all typical of modern web applications but offering no direct insight into the malicious payload.

Security reputation checks show a Gridinsoft trust score of 0 / 100 and a VirusTotal detection count of 12 out of 93 scanned vendors, indicating that multiple antivirus engines have identified the domain as malicious. The domain appears on one public security blocklist and has been blocked by the PhishDestroy sinkhole. AlienVault OTX references include fourteen threat‑intel pulses that cite the same domain, reinforcing its association with phishing campaigns.

The current operational status is offline, and no further content has been captured beyond the generic Cloudflare warning page. Uncertainty remains regarding the specific credential‑harvesting mechanisms, target brands, or victim demographics, as the site’s internal pages have not been publicly archived. Defenders should continue to block purechallenger.world at DNS and proxy layers, monitor for any re‑activation of the domain, and consider sharing the observed indicators—registration details, IP address, SSL fingerprint, and detection counts—with internal threat‑intel platforms to enrich detection rules.