igsorteofifa2026[.]registo-seguro[.]com

The domain igsorteofifa2026.registo-seguro.com is currently active and serves content with an HTTP 200 response. It is hosted on Amazon infrastructure (AS16509) in the United States and resolves to IP 75.2.43.161. Registration was performed through GoDaddy.com, LLC on August 13, 2021, and the domain uses the DNSimple nameserver set (ns1‑ns4.dnsimple.com). The site presents a TLS certificate issued by Let’s Encrypt (YR2) and enforces HSTS, indicating a recent HTTPS deployment. Front‑end analysis shows the presence of Bootstrap, jQuery, and Google reCAPTCHA, which are typical of credential‑harvesting pages. Gridinsoft rates the site at 0/100, and VirusTotal reports 10 detections out of 91 scanners, confirming malicious activity. The domain appears on one public blocklist and is already blocked by PhishDestroy. While the page title "Banco Internacional del Perú" suggests an attempt to impersonate that financial institution, the actual page content has not been examined, so the exact phishing vector remains uncertain. Defenders should add the domain to internal blocklists, monitor DNS queries for the IP 75.2.43.161, and enforce email filtering to drop any messages referencing the Banco Internacional del Perú brand from this host. Continuous scanning of the host for changes is advised, and any credential submissions to the site should be treated as compromised.