wc26-fifa[.]com

This domain, wc26-fifa.com, is identified as a generic phishing site targeting users through fake FIFA 2026 branding. Analysis indicates the domain was designed to mimic legitimate FIFA-related platforms, likely to harvest credentials or distribute malicious payloads under the guise of event registration or ticketing. No specific crypto drainer kit signatures were detected, but the impersonation of a high-profile sports event suggests a broad phishing campaign aimed at exploiting user interest in FIFA 2026. Infrastructure analysis reveals the domain was registered on March 27, 2026, through Metaregistrar BV, a registrar frequently abused for malicious domains. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare services, a common evasion tactic to obscure hosting infrastructure. VirusTotal reports 14 out of 95 security vendors flagging this domain as malicious, while AlienVault OTX lists it in 4 threat intelligence pulses. The domain appears on 1 security blocklist and is currently blocked by at least one threat intelligence feed. Notably, the domain was never listed on Google Safe Browsing (GSB), indicating either recent activation or successful evasion of GSB detection mechanisms. Technologies detected include HTTP/3, which may have been leveraged to bypass traditional network security controls. As of the latest assessment, wc26-fifa.com is offline, returning a 522: Connection timed out error, suggesting takedown or voluntary deactivation by the threat actor. However, the domain remains registered, and the infrastructure could be reactivated or repurposed for future campaigns. Users who interacted with the domain prior to its takedown should assume credential exposure and initiate password resets for any accounts accessed during that period. Organizations are advised to block the domain and associated IP (188.114.96.3) at the perimeter, monitor for related indicators in logs, and educate users on recognizing event-based phishing lures. The elevated risk level persists due to the domain's registration remaining active and the potential for re-emergence.