worldcuphardrock[.]com

Analysis of the domain worldcuphardrock.com confirms it as an active phishing site targeting individuals seeking 2026 FIFA World Cup tickets, hotels, and VIP packages. The domain, registered on March 10, 2024, through a major registrar, currently resolves to the IP address 64.29.17.3, hosted on infrastructure belonging to a large cloud provider in the United States. The site presents itself with the page title 'World Cup 2026 | Tickets, Hotels & VIP Packages,' a common tactic to lure victims searching for legitimate event-related services. Security vendors have flagged this domain, with six out of ninety-five engines on a widely used scanning platform detecting malicious activity. It is also blocked by at least one security blocklist, and a 301 HTTP redirect suggests it may be funneling traffic to another malicious endpoint or attempting to evade detection. The SSL certificate, issued by a well-known certificate authority, does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. Nameservers associated with the domain are consistent with those used by the registrar, though this alone does not indicate compromise. The exact nature of the phishing operation remains unclear, as the site could be harvesting credentials, payment details, or distributing malware under the guise of event bookings. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels. Organizations handling event-related transactions or customer inquiries should monitor for references to this domain in logs, emails, or social engineering attempts. Given the domain's age and continued activity, it is likely part of a broader campaign targeting major sporting events, and similar domains may emerge as the 2026 World Cup approaches.