football-tickets[.]shop

Analysis of football-tickets.shop shows a newly registered domain (created June 03, 2026) that is currently active and returning HTTP 200 responses. The site presents the page title "FIFA World Cup 2026 Tickets — TicketPass," indicating an attempt to lure victims with a high‑profile sporting event. DNS resolution points to IP 35.157.26.135, hosted on an AWS EC2 instance in the eu-central-1 region (Germany). The domain is listed on the PhishDestroy blocklist, confirming prior detection of malicious use. Registration was performed through Dynadot Inc., and the site uses a Let’s Encrypt certificate (identifier YE1). VirusTotal records show the domain was scanned by 91 vendors with no detections reported at the time of analysis, but this absence does not constitute evidence of safety. While the page content has not been directly examined, the combination of a brand‑related title, recent registration, and blocklist presence strongly suggests a generic phishing campaign targeting users seeking World Cup tickets. Defenders should block the domain at perimeter filters, monitor DNS queries for the associated IP, and consider adding the IP to reputation lists. Incident response teams should treat any credentials or personal data submitted to this site as compromised and advise affected users to reset passwords and review account activity. Continued observation is recommended to detect any evolution of the infrastructure or additional payloads.