vote-worldcuponpump[.]com

Analysis of vote-worldcuponpump.com indicates it is an active phishing domain targeting users with a WorldCupCoins-themed scam. The domain was registered on June 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain is proxied behind Cloudflare, resolving to IP address 172.67.199.104, located in Canada. The site uses Cloudflare Browser Insights and HTTP/3, common among phishing pages to evade detection and improve performance. The page title 'WorldCupCoins' suggests an attempt to lure victims with a cryptocurrency or sports-related offer, though the exact mechanics of the scam are not yet confirmed. The domain has been flagged by multiple threat intelligence sources. It appears in two AlienVault OTX pulses and is listed on two security blocklists, including PhishDestroy and ScamSniffer. Four of 91 security vendors on VirusTotal detect the domain as malicious. A Gridinsoft trust score of 0/100 further supports its classification as high-risk. SSL certification is provided by Google Trust Services, which does not validate the legitimacy of the site but ensures encrypted connections, a tactic often exploited to appear trustworthy. Defenders should treat this domain as active and malicious. Block access at the network level using the provided IP and domain. Monitor for related domains registered through the same registrar or using similar naming patterns. If internal logs show user interaction with this domain, initiate incident response procedures to assess potential credential theft or financial fraud. Additional analysis of the site's content and backend infrastructure is recommended to determine the full scope of the campaign.