worldcupvote[.]live

The domain worldcupvote.live has been identified as a high-risk brand impersonation threat specifically targeting the Solana ecosystem. Analysis confirms this domain was designed to mimic a legitimate token voting campaign under the guise of a "World Cup 2026 on Solana" event, with the page title "$WORLDCUP · Vote Your Nation · World Cup 2026 on Solana." The domain is currently offline, but prior activity indicates malicious intent to deceive users into interacting with fraudulent smart contracts or disclosing sensitive credentials. Infrastructure analysis reveals the domain was registered through NameSilo, LLC on May 18, 2026, and resolved to the IP address 188.114.97.3. Security vendor detections include 17 of 95 flags on VirusTotal, while three independent security blocklists have listed the domain. Additional indicators include a Gridinsoft trust score of 0/100 and confirmed blocks by multiple security providers. The site employed Cloudflare for hosting and protection, utilizing technologies such as HSTS, HTTP/3, and Cloudflare Browser Insights to enhance perceived legitimacy. As of the latest assessment, worldcupvote.live remains offline, though the infrastructure may be reactivated under a different domain. Users and organizations are advised to treat any related domains with extreme caution, particularly those promoting token distributions or voting mechanisms tied to Solana. Network-level blocking of the observed IP (188.114.97.3) and monitoring for newly registered domains with similar naming patterns are recommended. Security teams should update detection rules to include this campaign’s indicators and educate users on verifying official project communications through verified channels only.