nrgworldcup[.]com

This domain, nrgworldcup.com, is flagged as a phishing site impersonating official FIFA World Cup 2026 services. Analysis indicates the site targeted users seeking tickets, hotels, and VIP packages for the upcoming event, leveraging the high demand and urgency associated with major sporting events. The page title, 'World Cup 2026 | Tickets, Hotels & VIP Packages,' aligns with common phishing tactics designed to exploit consumer interest in exclusive offerings. No specific drainer kit or cryptocurrency-related fraud components were identified in this instance, distinguishing it from crypto-focused phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was detected by 7 out of 95 security vendors on VirusTotal, reflecting elevated risk. It was registered on March 10, 2024, through GoDaddy.com, LLC, and resolved to the IP address 216.198.79.131. The domain appears on one security blocklist and was actively blocked by PhishDestroy. The SSL certificate was issued by GoDaddy.com, Inc., a common registrar and certificate authority, which does not inherently indicate malicious activity but is frequently exploited in phishing infrastructure. No Google Safe Browsing (GSB) hits were reported at the time of assessment. The domain is currently offline, reducing immediate exposure to end users. However, residual risk remains due to potential re-activation or migration of the phishing infrastructure to alternative domains. Response actions should include monitoring for related domains registered under the same registrar or resolving to the same IP address, as threat actors often reuse infrastructure. Organizations are advised to update blocklists with the domain and associated IP, while users should verify the legitimacy of any World Cup 2026-related offers through official FIFA channels. Continuous vigilance is recommended, particularly during high-profile events where phishing activity typically spikes.