muaythai[.]sport

The domain muaythai.sport was registered on 14 March 2026 through COREhub and is presently hosted on an IP address 81.28.12.12 belonging to AS199524 G-Core Labs S.A. in the United States. The site serves content over HTTPS using a Let’s Encrypt (E7) certificate, and HTTP requests return a 200 status code. The domain is already listed on a phishing blocklist and has been flagged by PhishDestroy.

The landing page presents the title “The Official Website of the International Federation of Muaythai Associations (IFMA)”, mirroring the legitimate IFMA site. The site runs on a standard WordPress stack with MySQL, PHP, Yoast SEO, Nginx, and front‑end libraries such as Underscore.js, Swiper and Lightbox, which are commonly used by compromised or clone sites to reproduce authentic‑looking interfaces.

Infrastructure analysis shows the domain resolves to the same IP as other G‑Core‑hosted sites and uses the authoritative name servers ns1.gcorelabs.net and ns2.gcdn.services. Mail exchangers are configured to Google’s SMTP endpoints (smtp.google.com and aspmx.l.google.com), a pattern often employed to lend credibility to phishing campaigns. VirusTotal scans have returned 15 positive detections out of 95 engines, reinforcing the malicious assessment.

Defenders should add muaythai.sport to network and email filtering rules, enforce TLS inspection to capture any credential submissions, and consider sinkholing the IP address if feasible. Monitoring of DNS queries for the associated name servers can provide early warning of related campaign activity. End‑user awareness training should highlight the visual similarity of the page title and the use of a legitimate‑looking SSL certificate, urging verification of the true IFMA domain before entering any personal or financial information.