worldcupai[.]pro

Analysis of worldcupai.pro indicates this domain was created on May 27, 2026, and is currently classified as a generic phishing site with an elevated risk level. As of July 23, 2026, the domain is offline, but prior infrastructure reveals it resolved to IP address 172.67.171.3, hosted on Cloudflare’s network in Canada. The domain was registered through NameCheap, Inc., and uses Cloudflare nameservers (walt.ns.cloudflare.com and bristol.ns.cloudflare.com). A Let’s Encrypt SSL certificate (E7) was issued, which is common for both legitimate and malicious sites.

Security vendors have flagged this domain: it appears on three blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 0/100. Two of 91 security vendors on VirusTotal detected the domain as malicious, though this does not represent a full consensus. The specific content or target of the phishing scheme is not confirmed in available data, but the domain name suggests a possible association with World Cup-related lures, such as fake promotions, ticket scams, or credential harvesting. Defenders should treat this domain as compromised.

While it is currently offline, the infrastructure remains registered and could be reactivated. Block the domain and its resolved IP at perimeter controls, and monitor for any DNS changes or renewed activity. If internal logs show user interaction with this domain, initiate incident response procedures for potential credential exposure or malware delivery. Given the use of Cloudflare, additional scrutiny of traffic to 172.67.171.3 may be warranted, though this IP is shared across many sites and should not be blocked outright without further evidence of malicious activity.