proxyreviews[.]org

Analysis as of July 28 2026 indicates that the domain proxyreviews.org is actively being used in a high‑risk phishing campaign. The domain was registered through Namecheap Inc on September 17 2025 and is delegated to the registrar‑provided name servers dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to the IPv4 address 162.255.119.168, which is currently listed on a single public security blocklist and is specifically blocked by the PhishDestroy feed. VirusTotal has recorded 7 detections out of 91 scanned engines, confirming that multiple security vendors have observed malicious activity associated with the domain. The domain appears on one additional blocklist, reinforcing its classification as a phishing source.

No evidence of a valid SSL certificate, HTTP status code, or page title has been disclosed in the intelligence set, indicating that such telemetry was not captured at the time of analysis. The lack of publicly available SSL/TLS fingerprint prevents fingerprint‑based blocking, and the absence of a retrieved page title means the specific brand or service being spoofed cannot be confirmed at this stage. Threat actors may be using the domain as a redirector to a secondary credential‑collection site, a common tactic observed in other campaigns that share the same hosting provider. The IP address 162.255.119.168 is hosted in a data center that has previously been associated with malicious phishing infrastructure, although the precise autonomous system number was not disclosed.

The registrar information, recent creation date, and the presence of the domain on a known phishing blocklist suggest a typical infrastructure pattern for short‑lived phishing sites that rely on fast‑flux hosting and inexpensive registration. Defenders should block proxyreviews.org at perimeter and DNS layers, monitor outbound connections to 162.255.119.168, and update detection signatures with the observed VirusTotal indicators.