otworldcup[.]pages[.]dev

Analysis conducted on July 29, 2026, identifies otworldcup.pages.dev as an active phishing domain targeting users through a FIFA World Cup-themed lure. The domain was registered on June 11, 2026, via Cloudflare Pages, a platform frequently exploited for rapid deployment of malicious content due to its free hosting and automatic SSL provisioning. Infrastructure analysis reveals the domain resolves to IP address 172.66.47.107, which is part of Cloudflare’s network, a common tactic to obscure hosting origins and evade IP-based blocking. At the time of assessment, 12 of 91 security vendors on VirusTotal flagged the domain as malicious, indicating moderate consensus among detection engines.

The domain appears on one security blocklist and is actively blocked by PhishDestroy, further corroborating its classification as a phishing threat. The exact content and mechanics of the phishing campaign remain unconfirmed, as the page’s visual elements, login forms, or specific brand impersonation have not been analyzed. However, the domain name suggests an attempt to exploit interest in the FIFA World Cup, a recurring theme in phishing operations targeting sports enthusiasts. No evidence links this domain to a known phishing kit or specific threat actor.

Defenders are advised to treat otworldcup.pages.dev as a confirmed phishing domain and implement blocking at the DNS or network level. Organizations should monitor for user interactions with the domain and review logs for potential credential harvesting or malware delivery attempts. Given the domain’s recent registration and active status, continued monitoring for shifts in detection rates or infrastructure changes is recommended.