cschallenger[.]world

The domain www.cschallenger.world was registered on February 21, 2026 and is currently classified as a high‑risk generic phishing site. Analysis indicates the domain is actively serving web content (HTTP status 200) and has been flagged by the PhishDestroy blocklist. The page title returned by the server reads "Zorix VPN — Подписка на цифровой интернет‑сервер", confirming the use of a VPN‑related brand name to lure victims. The site is listed on a single public blocklist and carries a Gridinsoft trust score of 0 out of 100, underscoring its malicious nature.

Infrastructure examination shows the domain is hosted on the nameservers dns1.regway.com, dns2.regway.com, dns3.regway.com, and dns4.regway.com. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar commonly associated with rapid domain provisioning. VirusTotal reports that 3 out of 95 security vendors have flagged the domain, providing additional corroboration of its malicious intent despite the low detection count.

The observed page title and the generic phishing classification suggest the site is likely being used to harvest credentials for VPN services or to distribute malicious payloads under the guise of a legitimate subscription offer. No further technical artifacts such as malicious scripts or payload hashes were disclosed, leaving the exact attack vector uncertain. However, the combination of a fresh registration, low trust score, and active blocklist status points to a purpose‑built phishing campaign.

Defenders should immediately add www.cschallenger.world to network and email filtering rules, enforce DNS sinkholing for the associated nameservers, and monitor for any outbound connections to the domain. Continuous threat‑intel feeds should be consulted for any emerging indicators related to the Zorix VPN brand, and incident response teams should be prepared to investigate credential compromise reports that reference the domain or its apparent subscription offer.