fifa-26-worldcup[.]com

This domain is flagged as a credential harvesting phishing site targeting users interested in the FIFA 2026 World Cup. Analysis indicates the infrastructure was designed to impersonate official event pages, likely to collect login credentials, payment details, or personal information under false pretenses. The domain’s elevated risk level is supported by multiple technical indicators and third-party validations. Infrastructure analysis reveals the domain was registered through Metaregistrar BV on March 27, 2026, and currently resolves to IP address 172.67.202.148. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The domain appears in four threat intelligence pulses on a public threat-sharing platform and is listed on one security blocklist. Additionally, the page title displays a 522 connection timeout error, suggesting the server may have been taken offline or is experiencing temporary disruption. Technologies detected include Cloudflare and HTTP/3, which may have been leveraged to obfuscate the origin of the phishing content. Mitigation steps for this threat type include blocking the domain and its associated IP address at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain. Users who may have interacted with the site should be advised to reset credentials for any accounts accessed after visiting the domain, particularly if they entered sensitive information. Monitoring for similar domains using event-related keywords (e.g., FIFA, World Cup, 2026) is recommended to identify potential copycat infrastructure. Given the domain’s registration date in 2026, long-term vigilance for related campaigns is warranted as the event approaches.