# 2026 FIFA World Cup Phishing Campaign — 222 Typosquatting Domains, 203 IPs, 4 Operator Clusters (Flare)

> Flare researchers documented a distributed phishing ecosystem targeting the 2026 FIFA World Cup that has expanded to 222 typosquatting domains (206 active) hosted across 203 unique IP addresses — nearly 2.8x the domains and 14x the hosting footprint of an earlier 79-domain report. Four distinct operator clusters share fifa.com page templates that serve fake ticketing portals, copycat stores, and credential-harvesting login forms that silently accept any input. 80.6% of campaign IPs sit behind Cloudflare as a reverse proxy and Cloudflare has independently flagged at least three campaign domains as suspected phishing.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0569
- **ID:** TL-2026-0569
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PHISHING ECOSYSTEM OVERVIEW

On May 22, 2026 Flare published an expanded analysis (shared with Cyber Security News) of an ongoing phishing operation built around the 2026 FIFA World Cup tournament. Where an earlier report identified 79 typosquatting domains on 14 hosting IPs, the broadened dataset — built from passive DNS, Certificate Transparency (CT) logs, and WHOIS enrichment — now confirms 222 domains, 206 currently active, resolving to 203 unique IP addresses. The operation is fueled by tournament-driven urgency: fans searching for tickets, merchandise, and official streaming hubs are funneled to convincing fifa.com clones that harvest credentials, payment card data, and personal information.

FOUR OPERATOR CLUSTERS (SHARED TEMPLATES, INDEPENDENT INFRASTRUCTURE)

Flare's clustering analysis (page-template fingerprints, TLS certificate reuse, WHOIS overlaps, registrar choice) identifies four distinct operator groups that share the same phishing kit but operate independently:

- Cluster A — The largest cluster (~86 domains). Domains directly mimic the fifa.com address using typosquatting tricks: hyphenated variants (fifa-com.store, fifa-com.site, fifa-com.shop, fifa-com.one), prefix/suffix mutations (www-fifaworldcup.*), and TLD swaps (.shop, .site, .store, .one, .vip, .top). Heavy reliance on GNAME.COM and GoDaddy registrars.
- Cluster B — 14 .shop domains with generic, non-FIFA names (e.g. dustdigitalsw.shop, originally registered 2015 and repurposed for World Cup fraud) that nonetheless serve the same fraudulent landing page. Registrant identity is the placeholder 'Bill John / Newark'. Designed to evade brand-keyword monitoring that only watches fifa* lookalikes.
- Cluster C — 3 .cn ccTLD domains (https-fifa.cn, ww-fifaweb.cn, fifawebsite.cn) all registered March 28, 2026 via a single Gmail address. The .cn footprint and Gmail registration pattern suggest a China-based independent actor working with the same shared scam kit.
- Cluster D — Uses the fake registrant organization '888 shi jie bei guan li you xian gong si' ('888 World Cup Management Co Ltd') and openly references the tournament. Observed domains include www-fifaworldcup.one, www-fifaworldcup.vip, and fifa-com.one.

PAGE TEMPLATES AND VICTIM EXPERIENCE

Victims arriving at any cluster's domain receive one of three template variants: (1) a fake ticketing portal that mimics the fifa.com ticketing UI and collects PII plus payment card data at checkout; (2) a fake merchandise store impersonating the official FIFA Store; (3) a credential harvest form that silently accepts any input — usernames or emails are stored regardless of password validity, and victims are redirected to the legitimate fifa.com to mask the theft. All templates load the same shared CSS and JavaScript assets, leaving a consistent DOM-level fingerprint across clusters.

HOSTING AND REGISTRATION PATTERNS

80.6% of campaign IPs sit behind Cloudflare's reverse proxy, hiding origin servers and complicating takedown coordination. Five hosting IPs each front multiple campaign domains, with 38.246.249.74 alone hosting 8 separate fraudulent sites. GNAME.COM (~94 domains, 42%) and GoDaddy (~42 domains, 19%) collectively control 61% of campaign domains — Flare recommends prioritizing bulk abuse reporting to those two registrars as the fastest takedown lever. Registration velocity is sharply increasing: 52 domains in the first 17 days of April 2026 with new domains appearing almost daily, and three concentrated registration dates (March 27 2026, March 28 2026, November 17 2025) account for >36% of all known registrations.

TLS CERTIFICATE REUSE AS DETECTION SIGNAL

Four SHA-1 certificate fingerprints are reused across multiple campaign domains (one cert fronts 3 domains, three more front 2 domains each). This certificate reuse is a strong cross-domain pivot for hunters: any newly observed CT log entry sharing one of these fingerprints can be treated as part of the active campaign.

INDEPENDENT VALIDATION

Cloudflare has independently flagged three campaign domains (fifa-com.store, fifa-com.site, fifa-com.shop) as suspected phishing, validating the malicious classification through a third party that controls a large slice of the campaign's edge infrastructure.

DEFENSIVE GUIDANCE

Detection must operate at the campaign level rather than domain by domain — naming patterns alone miss Cluster B's generic .shop domains. Effective controls combine: (1) brand-keyword and IDN-homoglyph monitoring against fifa*, *fifa*, *worldcup* lookalikes plus the .one/.vip/.top/.shop/.site/.store TLDs; (2) Certificate Transparency monitoring keyed on the four shared SHA-1 fingerprints; (3) WHOIS-based alerting on registrant artifacts ('Bill John', 'Newark', '888 World Cup Management', the two Gmail addresses); (4) network blocking of the five high-density hosting IPs and bulk abuse reporting to GNAME.COM and GoDaddy; (5) DNS RPZ entries for the confirmed domains and category-level filtering on newly registered domains containing fifa/worldcup tokens.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1589.001 Gather Victim Identity Information: Credentials
- T1589.002 Gather Victim Identity Information: Email Addresses
- T1583 Acquire Infrastructure
- T1583.001 Acquire Infrastructure: Domains
- T1583.002 Acquire Infrastructure: DNS Server
- T1583.004 Acquire Infrastructure: Server
- T1583.006 Acquire Infrastructure: Web Services
- T1585.002 Establish Accounts: Email Accounts
- T1588.004 Obtain Capabilities: Digital Certificates
- T1608.001 Upload Malware
- T1608.004 Stage Capabilities: Drive-by Target
- T1608.005 Stage Capabilities: Link Target
- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1566.003 Phishing: Spearphishing via Service
- T1056.003 Input Capture: Web Portal Capture
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1102 Web Service
- T1090.004 Proxy: Domain Fronting
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [World Cup Phishing Campaign Nearly Triples With 203 Unique IP Addresses](https://cybersecuritynews.com/world-cup-phishing-campaign-nearly-triples/)
- [Flare Threat Research — FIFA World Cup 2026 Phishing Ecosystem (report shared with Cyber Security News)](https://flare.io/learn/)
- [FIFA Official — Ticketing Portal (legitimate brand reference)](https://www.fifa.com/fifaplus/en/tournaments/mens/worldcup/canadamexicousa2026)
- [Cloudflare Phishing Protection — Reporting URLs](https://www.cloudflare.com/trust-hub/abuse-approach/)
- [ICANN — Domain Abuse Reporting](https://www.icann.org/en/contractual-compliance/complaints)
- [APWG — Anti-Phishing Working Group Reporting](https://apwg.org/reportphishing/)
- [MITRE ATT&CK T1566 Phishing](https://attack.mitre.org/techniques/T1566/)
- [MITRE ATT&CK T1583.001 Acquire Infrastructure: Domains](https://attack.mitre.org/techniques/T1583/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0569