tyc5997[.]com

The domain tyc5997.com has been identified as a brand impersonation scam targeting users through a fraudulent FIFA World Cup betting platform. Analysis of the page title, "世界杯指定网站（中国区）有限公司" (Official World Cup Website (China Region) Co., Ltd.), confirms the domain impersonates official FIFA branding to deceive users into engaging with malicious betting or credential harvesting schemes. The domain is currently offline, but prior activity indicates a high-risk threat vector associated with financial fraud and identity theft. Infrastructure analysis reveals the domain was registered on January 12, 2026, through Eranet International Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 45.144.136.33, hosted under AS139659 (LUCIDACLOUD LIMITED) in Hong Kong, a network segment with a history of hosting phishing and fraudulent infrastructure. The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal, with detection labels including generic phishing and brand impersonation. The SSL certificate, issued by Let's Encrypt (R13), provides no inherent trust value, as it is commonly exploited by threat actors to lend a false sense of legitimacy to malicious sites. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the risk of reemergence remains elevated, particularly given the domain's future creation date (2026), which may suggest preemptive registration for upcoming campaigns. Organizations and users are advised to block the domain and its associated IP (45.144.136.33) at the network level. Security teams should monitor for related domains registered through Eranet International Limited or resolving to the same ASN. End users should verify the legitimacy of any World Cup-related websites through official FIFA channels and report suspicious domains to relevant security authorities or blocklist providers.