dappsoccer[.]com

Analysis of dappsoccer.com indicates that the domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 104.21.14.238, which is hosted by Cloudflare (AS13335) in the United States. The authoritative nameservers are diana.ns.cloudflare.com and johnny.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site presented a HTTP/3 response and did not present an SSL certificate, resulting in an unsecured connection. The sole observed HTTP response returned the page title “404 Not Found”, suggesting that the malicious landing page has been removed or the site is currently offline.

The campaign is classified as wallet/seed phishing targeting the MetaMask brand, as indicated by the “brand impersonation” label and the explicit brand target. The domain appears on three public security blocklists and is listed as blocked by PhishDestroy, MetaMask’s own protection mechanisms, and the SEAL blocklist, reinforcing the assessment of malicious intent. VirusTotal analysis recorded two detections out of ninety‑three scanning engines, providing additional independent confirmation of suspicious activity. Scamadviser assigned a trust score of 40 out of 100, which is consistent with a low‑reputation registration.

Evidence does not reveal the specific phishing kit or any observed credential‑stealing pages; the current 404 title and the offline status limit further forensic observation. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation of the same host or similar Cloudflare‑hosted IPs, and update threat‑intel feeds with the registrar and nameserver details. Ongoing watch for new registrations that reuse the NiceNIC registrar or the diana/johnny Cloudflare nameservers is recommended, as adversaries frequently recycle infrastructure.