fifa[.]ceo

Analysis of the domain fifa.ceo indicates active credential-phishing infrastructure targeting users associated with FIFA-related services. The domain was registered on June 12, 2026, through NameSilo, LLC, a registrar frequently observed in phishing campaigns due to its low-cost registration and privacy protection services. As of July 29, 2026, the domain appears on one security blocklist, and 16 of 91 security vendors on VirusTotal have flagged it as malicious, reflecting an elevated risk classification. The specific detection engines and signatures triggering these alerts are not disclosed in available intelligence, though the volume of detections suggests a recognized pattern consistent with credential-harvesting pages.

Infrastructure analysis reveals no additional hosting or IP details, limiting further attribution. The domain's creation date aligns with recent phishing trends, where newly registered domains are rapidly weaponized to evade reputation-based defenses. While the exact content of the site remains unanalyzed, the domain name implies a focus on FIFA branding, likely designed to exploit user trust in official-looking URLs.

Defenders should treat this domain as high-risk for credential theft and implement blocking at the DNS or network level. Monitoring for related domains registered through the same registrar or exhibiting similar naming conventions is recommended to preemptively disrupt associated campaigns. No evidence currently links this domain to a known phishing kit or broader campaign infrastructure, though continued observation is warranted given its active status.