fifaweb[.]live

Analysis of www.fifaweb.live shows an active high‑risk phishing infrastructure. The domain returns an HTTP 301 redirect, is protected by a Let’s Encrypt certificate (issuer E8), and is served from Cloudflare edge IP 104.21.61.96 located in Canada. Registration was performed through GoDaddy.com, LLC, and the authoritative nameservers are elsa.ns.cloudflare.com and suullivan.ns.cloudflare.com. VirusTotal records indicate that 8 of 91 security vendors have flagged the domain, and AlienVault OTX cites its appearance in two threat‑intel pulses. The site is currently blocked by the PhishDestroy sinkhole and appears on one public blocklist. While the precise landing page content has not been publicly disclosed, the combined indicators confirm a credential‑harvesting operation targeting users who may be lured by the fifaweb.live branding. Defenders should add the domain and its resolving IP to outbound allow‑list filters, enforce DNS‑level blocking, and monitor for any traffic to the associated Cloudflare nameservers. Continuous re‑scanning on VirusTotal and correlation with internal phishing detection logs are recommended to capture any evolution of the payload or hosting changes.