www-fifaworldcup[.]com

The domain www-fifaworldcup.com has been identified as a credential theft phishing domain, masquerading as an official FIFA World Cup website to steal login credentials and personal information from unsuspecting football fans. This brand impersonation scheme exploits the global excitement surrounding the tournament to lure victims into entering sensitive data. No specific crypto drainer kit was detected, but the phishing infrastructure is designed for identity theft rather than cryptocurrency theft. PhishDestroy categorizes this as a high-risk threat due to the trusted brand being exploited and the domain's technical indicators pointing to malicious intent.

Technical analysis reveals that VirusTotal flagged this domain with 11 out of 95 security vendors reporting it as malicious. The domain was registered through Metaregistrar BV and created on March 26, 2026, which is surprisingly recent given the phishing campaign appears to target the 2026 World Cup. It resolves to IP address 188.114.97.3, which is associated with Cloudflare's infrastructure, suggesting the attackers are using a content delivery network to obscure their true hosting location. The domain lacks an SSL certificate, a red flag for any site requesting credentials. AlienVault OTX found this domain in 4 threat intelligence pulses, and it appears on 1 security blocklist. Currently, the domain returns a 522 Connection Timed Out error, indicating the hosting server is unresponsive. Google Safe Browsing status was not explicitly provided but based on the data, it is likely flagged or blocked.

As of the latest check, www-fifaworldcup.com is offline and no longer resolving, which is a positive sign. The appropriate response actions taken include reporting the domain to security vendors and blocklist operators, and the domain registrar may have suspended it. However, users who previously visited the site may still be at risk of credential compromise. PhishDestroy recommends that anyone who entered personal information on this site should immediately change their passwords for FIFA-related accounts and any other services using the same credentials. Enable two-factor authentication where possible and monitor financial accounts for suspicious activity. Stay vigilant for similar phishing domains that may appear during major sporting events.