philaworldcup[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting FIFA World Cup 2026 enthusiasts. Analysis indicates the infrastructure was designed to harvest user credentials, payment details, and personal data under the guise of offering tickets, hotels, and VIP packages for the upcoming sporting event. The fraudulent nature is reinforced by the domain's page title, which explicitly mimics official FIFA 2026 branding to deceive visitors seeking legitimate event services. Infrastructure analysis reveals the domain philaworldcup.com was registered on March 10, 2024, through GoDaddy.com, LLC, and resolves to the IP address 216.198.79.195. The SSL certificate is issued by GoDaddy.com, Inc., a common registrar for both legitimate and malicious domains. At the time of assessment, the domain appeared on one security blocklist and was flagged by 8 out of 95 security vendors on VirusTotal. Detection rates and blocklist inclusion suggest active monitoring by security platforms, though the domain has since been taken offline. Mitigation measures for this type of credential theft threat include verifying domain authenticity through official event channels before entering sensitive information. Users should cross-reference domain registration dates, SSL certificates, and IP resolutions with known legitimate sources. Organizations are advised to implement domain-based email filtering rules to block messages originating from or linking to philaworldcup.com. Security teams should monitor for similar impersonation patterns, particularly domains registered shortly after major event announcements, and update detection signatures to include the identified IP address and registrar details.