fifa-com[.]xyz

This domain, fifa-com.xyz, was designed to trick soccer fans into believing they were buying official tickets for the FIFA World Cup 2026. The page title claimed to offer tickets, host cities, dates, and teams, but in reality it was a phishing site that likely aimed to steal personal information and payment details from unsuspecting visitors. The site impersonated the official FIFA brand to appear legitimate, but it was a classic example of a credential-harvesting and financial fraud operation.

PhishDestroy's investigation shows that fifa-com.xyz was created on March 20, 2026, and registered through Go Daddy, LLC. It resolved to IP address 188.114.96.3 and used a Let's Encrypt SSL certificate (E8) to appear secure. The domain was flagged by 8 out of 95 security vendors on VirusTotal, indicating broad consensus among security tools that it is malicious. It also appeared on one security blocklist and was found in four threat intelligence pulses on AlienVault OTX, confirming it was actively tracked by the security community. Fortunately, the domain is now offline, but its short lifespan suggests a targeted campaign during the World Cup buildup.

If you visited fifa-com.xyz or entered any information, take immediate action. Change any passwords you may have used on that site, especially if you reuse passwords across accounts. Contact your bank or credit card provider if you entered payment details, and monitor your accounts for unauthorized transactions. Consider enabling two-factor authentication on important accounts. To stay safe, always verify official event websites through trusted sources like PhishDestroy before entering sensitive data. Remember, if a deal seems too good to be true, it probably is a scam.