allocations-worldcup[.]fun

This domain, allocations-worldcup.fun, is actively hosting a crypto drainer phishing scheme targeting users with the false pretense of "World Cup Coins." The site remains operational as of the latest verification, presenting itself as a cryptocurrency distribution platform tied to a major sporting event. No legitimate association with any recognized brand or event has been identified, and the infrastructure is designed to deceive users into connecting wallets, leading to unauthorized fund transfers. Analysis indicates the domain was registered on May 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.64.88, hosted on Cloudflare’s network (AS13335). Despite its malicious intent, the domain has not been flagged by any of the 95 vendors on VirusTotal, though it appears on four security blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Let’s Encrypt (identifier: YE1), a common choice for both legitimate and malicious sites. The domain’s creation date is anomalous, suggesting either a typo or intentional misconfiguration to evade temporal-based detection. Infrastructure analysis reveals the site remains accessible and unmitigated. Organizations and individuals are advised to block the domain and its resolving IP at the network level. Wallet providers should integrate the domain into their real-time phishing filters, and users should be cautioned against interacting with any site offering "World Cup Coins" or similar unsolicited cryptocurrency distributions. Monitoring for newly registered domains with similar naming patterns (e.g., "worldcup" + financial terms) is recommended to preempt further campaigns.