fifa[.]gold

The domain fifa.gold is an active generic phishing threat identified by PhishDestroy, targeting users interested in the FIFA World Cup 2026. The page title, "FIFA World Cup 2026™ Tickets | Host Cities, Dates, Teams, Tickets," is designed to lure victims into providing personal and financial information under the guise of ticket purchases. No specific drainer kit has been identified, but the site's deceptive nature poses significant credential and data theft risks.

Technical indicators reveal a high-risk profile: VirusTotal flags the domain with 18 out of 95 security vendors marking it as malicious. The domain was created on November 17, 2025, and is registered through GNAME.COM PTE. LTD. It resolves to IP address 104.225.235.49 and lacks an SSL certificate, further signaling its illegitimate intent. AlienVault OTX associates it with four threat intelligence pulses, and it appears on one security blocklist, though it is not currently on Google Safe Browsing's blocklist.

As of now, fifa.gold remains active online, continuing to pose a risk to unsuspecting users. PhishDestroy recommends that users avoid visiting the domain entirely and report any encounters to relevant cybersecurity authorities. Organizations should update their web filters to block this domain and educate users about the dangers of phishing sites mimicking major events like the World Cup.