worldcup-download[.]com

This domain is flagged as a phishing site designed to impersonate official FIFA World Cup streaming platforms. The page title, written in Chinese, translates to 'World Cup Live Broadcast_World Cup Live Platform Video Download_World Cup Broadcast Schedule CCTV,' suggesting an attempt to deceive users seeking legitimate sports streaming services. Analysis indicates the domain likely targets individuals searching for free or unauthorized access to live sports content, redirecting them to malicious payloads or credential harvesting forms. Infrastructure analysis reveals the domain resolves to the IP address 156.254.254.126 and is registered through TuringSign Inc. d/b/a Cosmotown, with a creation date of March 24, 2026—an anomalous future timestamp that may indicate automated or fraudulent registration practices. The domain appears on one security blocklist, and VirusTotal reports 8 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by TrustAsia Technologies, Inc., which, while not inherently malicious, is commonly exploited by threat actors to lend false legitimacy to phishing sites. Users who visited worldcup-download.com should immediately revoke any credentials entered on the site, as they may have been compromised. Devices used to access the domain should undergo a full malware scan using updated security tools, with particular attention to browser-based threats. Network-level indicators, including the domain and its associated IP (156.254.254.126), should be added to enterprise blocklists to prevent further access. Given the elevated risk level and the domain's current offline status, continued monitoring for related infrastructure or rebranding attempts is recommended.