worldcup26miami[.]com

This domain, worldcup26miami.com, is identified as a credential theft operation targeting individuals seeking FIFA World Cup 2026 tickets, accommodations, and VIP packages. Analysis confirms the site is currently offline, though prior activity suggests it was designed to harvest login credentials, payment details, and personal information under the guise of official event offerings. The fraudulent nature of the domain is reinforced by its impersonation of a major sporting event, a common tactic in credential theft campaigns. Infrastructure analysis reveals the domain was registered on March 10, 2024, through a widely used registrar. It resolves to the IP address 64.29.17.131 and is associated with an SSL certificate issued by a commercial certificate authority. The domain appears on one security blocklist and is flagged by 8 of 95 security vendors on a malware and phishing detection platform. The page title, 'World Cup 2026 | Tickets, Hotels & VIP Packages,' explicitly mimics legitimate event promotion sites, increasing the likelihood of successful deception. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure remains a potential risk for future malicious activity. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the interaction and monitor financial statements for unauthorized transactions. Event organizers and security teams should proactively monitor for similar domains leveraging the World Cup 2026 brand, particularly those registered through mass-market registrars with recent creation dates.