2026-world-cup-free-airtime-data[.]earnonline[.]pro

Analysis of 2026-world-cup-free-airtime-data.earnonline.pro shows that the domain resolves to the IPv4 address 66.45.244.171. The hosting IP is currently listed by the PhishDestroy remediation service, indicating that the infrastructure has been identified as malicious and is being actively blocked. VirusTotal scans have recorded detections from eight out of ninety‑one antivirus and URL‑reputation engines, confirming that multiple independent providers consider the domain malicious. The domain also appears on a public security blocklist, further reinforcing its categorisation as a threat.

The threat type is recorded as generic phishing, and the risk rating is elevated, with the operational status marked as active. No additional public metadata such as registrar information, SSL certificate details, or HTTP response codes have been released, so the exact delivery mechanism and content of the site remain unknown. Defenders should add the domain and its resolved IP address to outbound and inbound firewall deny lists, ensure DNS filtering solutions block both the FQDN and the associated IP, and monitor network logs for any connections to 66.45.244.171.

Because the site is already listed by PhishDestroy, existing threat‑intelligence feeds that include that provider can be leveraged to automate blocklist updates. Continuous re‑scanning of the domain on VirusTotal or similar platforms is advised to detect any changes in detection count that may indicate alterations to the payload or hosting. Organizations should also advise users to be wary of unsolicited messages referencing the 2026 World Cup and promises of free airtime, as these social‑engineering cues are consistent with the observed phishing campaign.