fifa-com[.]food

fifa-com.food is currently listed as active with an elevated risk rating. The domain is blocked by the PhishDestroy feed and appears on a single security blocklist. VirusTotal analysis shows that 13 of 91 scanned security vendors have flagged the domain as malicious, indicating that a subset of AV engines have identified phishing‑related behavior. No additional telemetry such as hosting IP, SSL certificate details, or HTTP response codes is available in the public intelligence, so the underlying infrastructure cannot be fully profiled at this time.

The limited detection footprint suggests that the malicious campaign may rely on a narrow set of indicators or that the site is newly deployed and has not yet attracted broader scrutiny. The inclusion of the term "fifa" in the second‑level domain is a classic homograph technique that aims to exploit the reputation of the international football organization. Because the page title and any credential‑capture forms have not been publicly disclosed, automated content analysis cannot confirm the exact phishing vector, but the vendor detections are consistent with credential‑harvesting sites. Defenders should treat the domain as hostile: it should be added to URL filtering and DNS deny lists, traffic to the host should be logged and inspected, and any endpoint alerts that reference the domain should be escalated.

Continuous monitoring of threat‑intel sources for new detections, blocklist additions, or changes in vendor verdicts is advised. Organizations should reinforce user awareness regarding unsolicited requests for FIFA‑related credentials and enforce multi‑factor authentication for any accounts that could be targeted. If possible, retrieve a sandbox sample of the page for behavioral analysis to confirm the phishing payload and to identify any secondary command‑and‑control endpoints.