worldcupcoin[.]sbs

The domain worldcupcoin.sbs was registered on May 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 188.114.97.3, which belongs to CloudFlare, Inc. in Canada. The authoritative name servers are june.ns.cloudflare.com and nikon.ns.cloudflare.com, indicating that the domain is fully proxied behind CloudFlare’s network. An HTTPS service is presented using a Let’s Encrypt certificate (issuer E7), but an HTTP request returns a 403 status, suggesting that the web server is configured to block direct access while possibly serving malicious content only to targeted browsers or via specific request parameters.

Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scans have resulted in 15 out of 95 security vendors flagging the domain as malicious, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in a single threat‑intelligence pulse, reinforcing its presence in the broader malicious ecosystem. These indicators collectively point to an active credential‑harvesting operation that leverages the popularity of World Cup‑related themes to lure victims.

While the observed data confirms the domain’s malicious posture, the exact payload, phishing kit, or targeted brand is not disclosed in the available intelligence. Defenders should block the domain at the DNS level, monitor outbound connections to 188.114.97.3, and enforce strict TLS inspection to detect any concealed payloads. Continuous re‑evaluation of the domain’s status is advised, as the underlying infrastructure may evolve or additional indicators could emerge from future analyses.