2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5821 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FIFA World Cup Lookalike Domain DNS Resolution (Scored)

TL-2026-5821 (2026 FIFA World Cup scam wave). Scores Sysmon DNS queries (EventCode 22) for FIFA/World Cup lookalike, typosquat and scam domains. Fires on FBI IC3 / Group-IB listed domains (fifa-ticket.live, fifa-tickets.vip, wvvw-fifa.com, fifa-com.com, fifa.city and others), on typosquat patterns of www.fifa.com, and on brand keywords combined with ticket/shop/stream/career lures while excluding official fifa.com, fifa.org and fifaplus.com. Resolution of such a domain is the first observable step of the cloned ticket-site, fake-shop and fake-streaming flows that harvest card data and 3-D Secure OTPs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1656, T1583.001, T1204.001
• Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=22, Microsoft Sentinel DnsEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h
| eval qname=lower(QueryName)
| eval ioc_hit=if(match(qname,"fifa-ticket[.]live|fifaworldcup26[.]sale|worldcup26ticket[.]com|2026fifaworldcuptickets[.]online|worldcup2026-tickets[.]com[.]mx|fifa-2026[.]xyz|filfa[.]org|wvvw-fifa[.]com|ww-fifa[.]com|fifa-com[.]com|fifa-online[.]com|fifa[.]city|fifa[.]cab|jobs-fifa[.]com|fifa-hiring[.]com|fifaworldcup-careers[.]com|fifa-tickets[.]vip|fifa-com[.]shop|www-fifa[.]com|wc26-fifa[.]com|fifa2026tickets-streamlive[.]com|mm-fifa[.]top|football-ticket[.]top|football-ticket[.]shop|football-game[.]shop|football-tickets[.]top"),1,0)
| eval brand_kw=if(match(qname,"(fifa|worldcup|world-cup|wc26)"),1,0)
| eval legit=if(match(qname,"(^|[.])(fifa[.]com|fifa[.]org|fifaplus[.]com)$"),1,0)
| where ioc_hit=1 OR (brand_kw=1 AND legit=0)
| eval kit_pattern=if(match(qname,"wvvw-fifa|ww-fifa|www-fifa|fifa-com|filfa[.]org|wc26-fifa|fifa-tickets|fifa-online|fifa[.]city|fifa[.]cab|fifa-2026"),1,0)
| eval lure_kw=if(match(qname,"ticket|hospitality|stream|live|shop|store|jersey|sale|career|hiring|jobs"),1,0)
| eval risk=ioc_hit*3+kit_pattern*2+lure_kw+brand_kw
| where risk>=2
| stats count as queries dc(qname) as distinct_domains values(qname) as domains max(risk) as max_risk min(_time) as first_seen max(_time) as last_seen values(Image) as processes by host, User
| convert ctime(first_seen) ctime(last_seen)
| sort - max_risk

Microsoft KQL

let ioc_domains = dynamic(['fifa-ticket.live','fifaworldcup26.sale','worldcup26ticket.com','2026fifaworldcuptickets.online','worldcup2026-tickets.com.mx','fifa-2026.xyz','filfa.org','wvvw-fifa.com','ww-fifa.com','fifa-com.com','fifa-online.com','fifa.city','fifa.cab','jobs-fifa.com','fifa-hiring.com','fifaworldcup-careers.com','fifa-tickets.vip','fifa-com.shop','www-fifa.com','wc26-fifa.com','fifa2026tickets-streamlive.com','mm-fifa.top','football-ticket.top','football-ticket.shop','football-game.shop','football-tickets.top']);
DnsEvents
| where TimeGenerated > ago(24h)
| where isnotempty(Name)
| extend qname = tolower(Name)
| extend ioc_hit = iff(qname contains_any (ioc_domains), 3, 0)
| extend brand_kw = iff(qname matches regex 'fifa|worldcup|world-cup|wc26', 1, 0)
| extend legit = qname matches regex '(^|[.])(fifa[.]com|fifa[.]org|fifaplus[.]com)$'
| where ioc_hit > 0 or (brand_kw > 0 and not(legit))
| extend kit_pattern = iff(qname matches regex 'wvvw-fifa|ww-fifa|www-fifa|fifa-com|filfa[.]org|wc26-fifa|fifa-tickets|fifa-online|fifa[.]city|fifa[.]cab|fifa-2026', 2, 0)
| extend lure_kw = iff(qname matches regex 'ticket|hospitality|stream|live|shop|store|jersey|sale|career|hiring|jobs', 1, 0)
| extend risk = ioc_hit + kit_pattern + lure_kw + brand_kw
| where risk >= 2
| summarize Queries = count(), Domains = make_set(qname, 25), MaxRisk = max(risk), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ClientIP
| order by MaxRisk desc

Sigma

title: FIFA World Cup Lookalike Domain DNS Query (TL-2026-5821)
id: 6f1d2a3e-5b7c-4e18-9a4d-1c2b3d4e5f01
status: experimental
description: Detects DNS queries for FIFA and World Cup lookalike, typosquat and scam domains listed by the FBI IC3 and Group-IB that impersonate official FIFA ticket, hospitality, shop and streaming sites.
references:
  - https://www.ic3.gov/PSA/2026/PSA260527
  - https://www.trendmicro.com/en_us/research/26/g/tracking-fake-sites-in-the-2026-world-cup-scam-wave.html
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.resource-development
  - attack.t1583.001
  - attack.defense-evasion
  - attack.t1656
  - attack.execution
  - attack.t1204.001
logsource:
  category: dns
detection:
  selection_ioc:
    query|contains: ['fifa-ticket.live','fifaworldcup26.sale','worldcup26ticket.com','2026fifaworldcuptickets.online','worldcup2026-tickets.com.mx','fifa-2026.xyz','filfa.org','wvvw-fifa.com','ww-fifa.com','fifa-com.com','fifa-online.com','fifa.city','fifa.cab','jobs-fifa.com','fifa-hiring.com','fifaworldcup-careers.com','fifa-tickets.vip','fifa-com.shop','www-fifa.com','wc26-fifa.com','fifa2026tickets-streamlive.com','mm-fifa.top','football-ticket.top','football-ticket.shop','football-game.shop','football-tickets.top']
  selection_kit:
    query|contains: ['wvvw-fifa','ww-fifa','www-fifa','fifa-com','filfa.org','wc26-fifa','fifa-tickets','fifa-online','fifa-2026']
  selection_brand:
    query|contains: ['fifa','worldcup','world-cup','wc26']
  selection_lure:
    query|contains: ['ticket','hospitality','stream','live','shop','store','jersey','sale','career','hiring','jobs']
  filter_legit:
    - query|endswith: ['.fifa.com','.fifa.org','.fifaplus.com']
    - query: ['fifa.com','fifa.org','fifaplus.com']
  condition: (selection_ioc or selection_kit or (selection_brand and selection_lure)) and not filter_legit
falsepositives:
  - Brand protection or threat intelligence teams resolving lookalike domains
  - Legitimate FIFA partner or fan sites not on the allow list
level: high

Known false positives:

• Brand-protection, SOC or threat-intel staff deliberately resolving lookalike domains for analysis
• Legitimate FIFA partner, sponsor, broadcaster or fan sites containing the fifa/worldcup keyword that are not on the allow list

Tuning notes: Add confirmed official FIFA, partner and broadcaster domains to the legit regex. Raise the risk threshold to 3 in noisy environments to alert only on IOC or typosquat-pattern hits. Refresh the IOC list from the FBI IC3 PSA and Group-IB reporting; the list is a point-in-time snapshot.

• 🔒 FIFA Lookalike URL Clicked from Email or Teams (Defender for Office 365) · unlock with TL Creds
• 🔒 Fake FIFA Live-Streaming Site Visit from Browser (SEO Poisoning Lure) · unlock with TL Creds
• 🔒 GHOST STADIUM Kit Fingerprint - Tawk.to Property and Meta Pixel in Web Traffic · unlock with TL Creds
• 🔒 FIFA Ticket, Shop or Pay Lookalike Host in Web Proxy Traffic · unlock with TL Creds
• 🔒 Fake FIFA Job and Careers Site DNS Lookup · unlock with TL Creds
• 🔒 FIFA Scam Redirector Domains and Community-Observed Sibling Infrastructure (DNS) · unlock with TL Creds
• 🔒 Cloned FIFA Ticket Site Login and Card Capture Paths via Web Proxy · unlock with TL Creds
• 🔒 FIFA Scam Hosting IPs and Payment Rail Contact · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-5821.

Sample indicators (3 of 33)

• IP address: 43.98.183[.]110
• Domain: fifa-ticket[.]live
• File hash: 3b8bb7631b39f455d31544b55ba97b49ab1888c1

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

Technical analysis

TrendAI (Trend Micro) tracked scam activity exploiting the 2026 FIFA World Cup (co-hosted by the United States, Canada and Mexico, 11 June to 19 July 2026) from January to June 2026. Using the keywords 'fifa' and 'worldcup' it identified 35,538 malicious or suspicious sites. Telemetry showed roughly 1.48 million visits from Japan, rising sharply after kickoff on 11 June. Japan was the primary focus of the Trend analysis, but the sites used auto-translation to reach users in many languages. Trend's article names no threat actor, malware family or CVE and publishes no IOCs in its text (its figures are images).

Three site categories were observed. (1) Fake shops (6,251 identified via 'FIFA', ワールドカップ and 日本代表) sell counterfeit or nonexistent jerseys and merchandise; many were stood up well before the tournament and promoted through SEO poisoning. (2) Cloned ticket and hospitality sites are near-copies of the official FIFA hospitality site, reusing its logo, design and assets, with auto-translation. They run a real-time phishing flow: the victim enters card details; the attacker receives them live and attempts a fraudulent payment elsewhere; the issuer sends a 3-D Secure OTP to the victim; the victim types the OTP into the fake site; the attacker uses it immediately; the victim is shown a fake order confirmation. Because the victim supplies the OTP, MFA is bypassed. The fake login page also forwards email addresses and passwords to the attackers and has no connection to FIFA's account system. (3) Fake live-streaming sites use pages named after real matches with a mock video player that never plays footage. Japanese queries such as 'fifa ワールドカップ 2026 無料配信' were boosted by SEO poisoning, and a compromised website of a US university research institute hosted multiple fake match pages. Victims pass through relay pages on blogging platforms; each click on the fake play button redirects to a different destination, including account-opening pages of trading services and major e-commerce sites (likely unwitting victims of affiliate ad fraud through a malicious ad network). Some pages demand 'registration' that harvests personal and card data or enrolls victims in recurring subscriptions.

Corroborating reporting: FBI IC3 PSA I-052726-PSA (27 May 2026) lists 36 spoofed FIFA domains (ticket, hospitality, store and fake FIFA job/career sites) and expects more. Group-IB's GHOST STADIUM report (27 May 2026) describes a separate, Chinese-speaking financially motivated cluster running a React-based fifa.com clone kit that replicates FIFA's PingIdentity SSO flow with the real client_id, across 300+ active domains out of 4,300+ FIFA-themed domains registered since August 2025 (about 3,800 parked), with Facebook ads as the main traffic source and multiple payment rails. The Hacker News (5 June 2026) summarises related activity including fake streaming apps delivering Android banking trojans and infostealer logs containing FIFA logins. These reports are context for the same lure theme; the Trend source does not attribute its 35,538 sites to GHOST STADIUM or any named actor, so attribution here is Unknown.

Defender relevance: block and monitor FIFA/worldcup lookalike domains and TLD variants, brand-protection takedowns (registrar and CDN abuse channels), user awareness (buy only via fifa.com, verify merchant and amount in 3-D Secure OTP SMS), and issuer-side fraud monitoring for card-not-present transactions and OTP use shortly after card entry.

MITRE ATT&CK techniques by tactic:

Credential Access

T1056.003 Input Capture: Web Portal Capture; T1111 Multi-Factor Authentication Interception

Collection

T1056.003 Input Capture: Web Portal Capture

Execution

T1204.001 User Execution: Malicious Link

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.008 Acquire Infrastructure: Malvertising; T1608.006 Stage Capabilities: SEO Poisoning

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation

Immediate actions

• Block and monitor lookalike domains containing 'fifa' or 'worldcup' (including typosquats such as wvvw-fifa.com, ww-fifa.com, fifa-com.com and alternate TLDs) at DNS and web-proxy layers
• Submit takedown requests for confirmed fake sites to the registrar and CDN/hosting abuse channels
• Advise users to type fifa.com directly or use bookmarks, and to avoid sponsored search results and social-media ads for tickets
• Report victims' fake domain, interaction details and payment information to the FBI IC3 (ic3.gov) or the local equivalent

Workarounds

• Purchase tickets and goods only from official websites reached directly, and watch matches only via official broadcasters and streaming services
• Do not register accounts or enter card details on unofficial 'free streaming' sites
• If an unfamiliar merchant or amount appears in a 3-D Secure OTP SMS, stop and contact the card issuer

Longer-term hardening

• Deploy brand-protection / digital-risk monitoring for newly registered lookalike domains and parked domains
• Issuers: monitor for fraudulent card-not-present payments and OTP use immediately after card capture; show merchant and amount clearly in 3-D Secure messages
• Use unique passwords per service and phishing-resistant authentication where available
• Run user awareness on fake ticket, shop and 'free streaming' lures around major sporting events

Affected and fixed versions

• FIFA — FIFA ticketing, hospitality and web brand (impersonated)
• Consumers — Ticket, merchandise and streaming buyers (primarily in Japan; multi-language targeting)
• Card issuers / payment networks — 3-D Secure OTP flows abused via real-time phishing

Timeline

• 2025-08-01 Group-IB's tracked registrations of fraudulent FIFA-themed domains begin (August 2025; month-level date), reaching 4,300+ domains with about 3,800 parked.
• 2026-01-01 TrendAI begins tracking sites containing 'fifa' or 'worldcup' (January 2026; month-level date); many fake shops were set up well before the tournament and promoted through SEO poisoning.
• 2026-04-27 Four football-themed redirector domains (locked-ioc-8, football-ticket.shop, football-game.shop, football-tickets.top) registered per Group-IB.
• 2026-05-27 FBI IC3 publishes PSA I-052726-PSA listing 36 spoofed FIFA domains; Group-IB publishes its GHOST STADIUM report on 300+ cloned FIFA ticket sites.
• 2026-06-05 The Hacker News summarises World Cup scam activity across FBI, Group-IB, Fortinet, Bitdefender, ThreatFabric and Kaspersky reporting.
• 2026-06-11 World Cup kicks off; TrendAI observes a sharp rise in visits from Japan to the fake sites after kickoff (about 1.48 million visits over the tracking period).
• 2026-06-30 End of TrendAI's January to June 2026 tracking window (month-level date), with 35,538 malicious or suspicious sites and 6,251 fake shops identified.
• 2026-07-19 Tournament concludes; lure theme expected to decline though parked and registered domains may be reused.
• 2026-07-29 Trend Micro publishes 'Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave'.

Sources cited

• FBI IC3 PSA I-052726-PSA: Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup ic3.gov · Advisory · 2026-05-27
• Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave (TrendAI / Trend Micro) Trend Micro · Research · 2026-07-29
• GHOST STADIUM (Group-IB) group-ib.com · Research · 2026-05-27
• FIFA World Cup 2026 Scams Are Already Live (The Hacker News) The Hacker News · News · 2026-06-05
• A single typo could derail your World Cup plans (Help Net Security) Help Net Security · News · 2026-05-28

More in phishing

• Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Tenant Social Engineering)
• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees

Further reading

• ChromaDB, LiteLLM, PraisonAI, Langflow RCEs