# PhishDestroy threat dossier — fifaworldcup2026hotels.com ================================================================ Fetched: 2026-06-28 08:50:17 UTC Canonical: https://phishdestroy.io/domain/fifaworldcup2026hotels.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 65/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, ArcSight Threat Intelligence, Fortinet, Gridinsoft, SOCRadar AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- Registrar: GoDaddy.com, LLC Nameservers: ["ns69.domaincontrol.com", "ns70.domaincontrol.com"] Registered: 2026-06-12 Expires: 2027-05-19 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-12 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-12 22:30:35 UTC (by PhishDestroy tracker) First reported: 2026-06-15 06:37:33 UTC (abuse notice filed) Last verified: 2026-06-28 08:20:34 UTC Neutralised: 2026-06-17 00:35:21 UTC Current status: taken down (registrar suspended or DNS dead) ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 22:46:08 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, fifaworldcup2026hotels.com, is confirmed to be a fake login scam designed to trick users into entering their credentials. The site was likely created to capitalize on the high interest and increased online activity surrounding the FIFA World Cup 2026, a major international sporting event. By impersonating legitimate booking services, the phishing site aimed to harvest sensitive information such as usernames, passwords, and possibly financial details from unsuspecting visitors. Infrastructure analysis reveals that the domain was registered through GoDaddy.com, LLC on June 12, 2026. The SSL certificate was issued by GoDaddy.com, Inc., which could have been used to create a false sense of security among users. The site was detected by 5 out of 95 security vendors on VirusTotal, indicating a moderate level of awareness and detection within the security community. Additionally, the domain appears on one security blocklist and has been mentioned in 4 threat intelligence pulses on AlienVault OTX. The web technologies detected on the site include Nginx and OpenResty, which are commonly used in web server configurations. The domain is currently offline, which may suggest that it has been taken down by authorities or the registrar. If users have visited fifaworldcup2026hotels.com and entered their login credentials or personal information, they should immediately change their passwords and monitor their accounts for any unauthorized activity. It is recommended to contact the relevant service provider to report the incident and seek further guidance. Users should also consider running a full system scan to ensure that no malware was installed as a result of visiting the site. To avoid similar scams in the future, users should verify the URL of any website they visit, especially those related to high-profile events, and only enter personal information on trusted and verified domains. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/fifaworldcup2026hotels.com/ JSON API: https://api.destroy.tools/v1/check?domain=fifaworldcup2026hotels.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 170,942 domains (13,576 alive under monitoring, 156,953 confirmed takedowns/dead). Site: https://phishdestroy.io