World Cup phishing campaign impersonating FIFA expands to 222 domains

A phishing and fraud operation impersonating FIFA ahead of the 2026 World Cup has expanded far beyond initial estimates, growing from 79 known domains on 14 IPs to at least 222 domains spread across 203 unique IP addresses. The sites mimic official FIFA branding, copy page structure, and reuse images and icons from the legitimate website to lure fans through typosquatted and lookalike domains such as vww-fifa[.]com and fifa[.]sale. Researchers said the infrastructure is designed to steal credentials and payment data, collect money for fake tickets or merchandise, and potentially compromise legitimate FIFA accounts so real tickets can be stolen and resold.

The latest investigation found the activity is not a single centralized campaign but at least four distinct operator clusters sharing scam templates while differing in hosting, registration patterns, and WHOIS fingerprints. Analysts linked parts of the infrastructure to repurposed aged .shop domains, a smaller .cn cluster, and domains using the fake registrant organization "888 World Cup Management Co Ltd." Most of the sites sit behind Cloudflare, which independently flagged several as phishing, and 206 of the 222 domains were still active at the time of reporting, with registrations accelerating in April. Researchers urged broader detection beyond obvious FIFA-themed names and called for registrar-level disruption, particularly involving GNAME.COM and GoDaddy.