cupschallenge[.]world

The domain cupschallenge.world was registered through Cloudflare, Inc. on 18 October 2025 and is currently taken offline. It resolves to the IPv6 address 2a06:98c1:3121::3, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are jose.ns.cloudflare.com and luciane.ns.cloudflare.com, confirming that the hosting infrastructure is fully provided by Cloudflare. The site presents the page title “Global | eSports and Gaming Community,” a generic title that does not reference the targeted brand. However, intelligence indicates that the domain is being used to impersonate the brand “celer,” classifying the activity as brand‑impersonation. VirusTotal records show that 16 of 95 scanned security vendors flagged the domain, and the site appears on at least one public blocklist.

PhishDestroy has already blocked the domain, and Google Safe Browsing labels it as a social‑engineering threat. AlienVault OTX contains the domain in 16 separate threat‑intel pulses, reinforcing its reputation as malicious. The SSL certificate is issued by Google Trust Services under the WE1 designation, and the site supports HTTP/3. An HTTP 403 response is observed, which is consistent with a deliberately restricted or takedown state. Scamadviser assigns a trust score of 1 out of 100, reflecting extreme risk.

From the available evidence, defenders can confirm that cupschallenge.world is associated with a high‑risk brand‑impersonation campaign targeting celer users. The exact payload, phishing page layout, or credential‑harvesting mechanisms have not been publicly disclosed, leaving the content of the malicious page uncertain. Nevertheless, the combination of multiple vendor detections, blocklist listings, Google Safe Browsing flagging, and OTX pulse presence provides sufficient confidence to treat the domain as malicious.