cdmxworldcup[.]com

This domain is flagged as an elevated-risk brand impersonation phishing site specifically targeting 2026 FIFA World Cup attendees. Analysis indicates the infrastructure was designed to fraudulently collect payments for non-existent tickets, hotels, and VIP packages under the guise of an official event portal. Infrastructure analysis reveals the domain cdmxworldcup.com was registered on March 10, 2024, through GoDaddy.com, LLC, a registrar frequently exploited for short-lived phishing campaigns. The site resolved to the IP address 216.198.79.3 and was hosted with an SSL certificate issued by GoDaddy.com, Inc., providing a superficial layer of legitimacy. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while PhishDestroy and one additional security blocklist have actively blocked it. The page title, 'World Cup 2026 | Tickets, Hotels & VIP Packages,' directly mimics official event marketing, a common tactic in brand impersonation schemes. Mitigation for this specific threat type requires heightened scrutiny of domains claiming affiliation with high-profile sporting events. Users should verify official ticketing channels through the event's authenticated website and cross-reference domain registration dates, as fraudulent sites are typically created shortly before or during the event. Payment requests should be treated as high-risk if originating from non-verified sources, particularly those using newly registered domains or generic hosting infrastructure. Organizations should update blocklists to include this domain and its associated IP to prevent further exposure.