As the countdown to the 2026 FIFA World Cup begins, threat actors are already on the field, building digital infrastructure designed to exploit fan excitement, disrupt ticketing, and siphon revenue from one of the world’s largest sporting events.
New research from Check Point Research, the threat intelligence arm of Check Point® Software Technologies, reveals a coordinated campaign to establish thousands of fake domains, botnets, and phishing tools, all masquerading as legitimate FIFA and host city assets.
This isn’t speculation. The campaign has already begun.
The Early Play: Fraud Infrastructure in Motion
Since August 1, 2025, Check Point has identified more than 4,300 newly registered domains spoofing FIFA, “World Cup,” or tournament host cities like Dallas, Miami, Toronto, and Mexico City. These registrations are not organic, they come in synchronized waves, often using identical DNS infrastructure, and are tightly clustered across a handful of bulk-friendly registrars like GoDaddy, Namecheap, Dynadot, and Gname.
Worryingly, many of these domains are designed for long-term use, including references to FIFA 2030 and 2034. This “domain aging” strategy allows fraudsters to build passive credibility over time, a tactic often seen in targeted brand abuse.
Real-Time Risk: Presale Phishing Incoming
FIFA’s first ticketing phase is already underway. Fans who entered the early presale draw (Sept. 9–19) will be notified of their results on September 29, with ticket purchases opening for selected users on October 1.
This window presents an ideal opportunity for fraud.
Threat actors are expected to flood inboxes and search engines with phishing emails, spoofed ticket confirmations, and fake queue portals, all timed to coincide with real FIFA communications. The likelihood of success increases when urgency is high, and expectations are real.
“What we’re seeing isn’t isolated cybercrime. Its infrastructure being built, at scale, to exploit global interest before the World Cup even kicks off,” said Amit Weigman,Evangelist at Check Point Software Technologies. “Threat actors are not waiting for 2026. They are matching their timeline to FIFA’s.”
What Check Point Research Found
- 4,300+ FIFA-related domains registered in less than 60 days, with peak activity between August 8–12 and again in early September.
- Registrar concentration across GoDaddy, Namecheap, Gname, and Dynadot enables bulk automation and rapid deployment.
- Linguistic targeting splits by audience: English for streaming, Spanish and Portuguese for ticketing and merchandise, French for European markets.
- Top-level domains include .com, .shop, .store, .online, and .football — often chosen for low cost and low friction.
- DNS overlaps suggest centralized control by small numbers of semi-professional operators using scripted fraud kits.
- Telegram channels and dark-web forums are already promoting fake tickets, counterfeit gear, and payment fraud toolkits.
Ticketing Disruption & Botnet Abuse
Beyond simple scams, Check Point uncovered evidence of systemic attacks designed to destabilize FIFA’s ticketing infrastructure.
Botnets are being trained to flood pre-sale queues, scoop up high-demand inventory, and manipulate dynamic pricing models. On underground markets, customized toolkits and proxy farms are being sold with FIFA-specific instructions, an echo of tactics used to disrupt major ticketing platforms like Ticketmaster.
The Bigger Threat Landscape
- Fans face exposure to phishing, financial fraud, and malware through fake ticket sites and livestreaming scams.
- FIFA and sponsors face brand abuse, lost traffic, and counterfeit commerce.
- Host cities and venues may see travelers targeted with geo-specific scams tied to accommodation, transport, or hospitality.
- The internet ecosystem, including ad networks, registrars, and messaging platforms, risks becoming a distribution layer for fraud.
Recommendations
For Infrastructure Stakeholders
- Proactively monitor domain registrations using “FIFA + year + city” naming patterns in multiple languages.
- Work with registrars to flag and remove suspicious domains quickly.
- Require identity verification for domains using tournament-related keywords.
For FIFA and Ticketing Partners
- Strengthen anti-bot and behavioral analysis systems ahead of each ticketing phase.
- Launch verified campaigns to outrank fraudulent search ads.
- Clearly communicate official channels and timelines to fans.
For Fans
- Buy tickets only from official FIFA sources.
- Scrutinize emails, especially for misspelled domains or “too good to be true” offers.
- Use browser security extensions and keep antivirus software up to date.
- Don’t trust Telegram links or social ads promoting “VIP access” or early offers.
Final Whistle
The World Cup is still months away, but the digital battle for 2026 has already begun. By mimicking FIFA’s timeline and leveraging real-world events like the upcoming presale window, threat actors are positioning themselves for maximum impact.
This campaign is not just opportunistic, it is orchestrated. And unless addressed now, it will continue to grow alongside the tournament’s global reach.
For more insights and visual examples, you can read the full breakdown on our blog.
