# 2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites

> Between January and June 2026, TrendAI (Trend Micro) identified 35,538 malicious or suspicious sites containing 'fifa' or 'worldcup' that impersonated FIFA, official partners and broadcasters. Cloned ticket and hospitality sites run real-time phishing for card details and one-time passwords (OTPs), which defeats OTP-based MFA, while fake shops (6,251 identified) and fake live-streaming sites with malicious ad redirects make up the rest of the wave.

- **Published:** 2026-11-12T04:25:33Z
- **Last reviewed:** 2026-11-12T04:25:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5821
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5821.png
- **ID:** TL-2026-5821
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (3 shown free below)

## Description

TrendAI (Trend Micro) tracked scam activity exploiting the 2026 FIFA World Cup (co-hosted by the United States, Canada and Mexico, 11 June to 19 July 2026) from January to June 2026. Using the keywords 'fifa' and 'worldcup' it identified 35,538 malicious or suspicious sites. Telemetry showed roughly 1.48 million visits from Japan, rising sharply after kickoff on 11 June. Japan was the primary focus of the Trend analysis, but the sites used auto-translation to reach users in many languages. Trend's article names no threat actor, malware family or CVE and publishes no IOCs in its text (its figures are images).

Three site categories were observed. (1) Fake shops (6,251 identified via 'FIFA', ワールドカップ and 日本代表) sell counterfeit or nonexistent jerseys and merchandise; many were stood up well before the tournament and promoted through SEO poisoning. (2) Cloned ticket and hospitality sites are near-copies of the official FIFA hospitality site, reusing its logo, design and assets, with auto-translation. They run a real-time phishing flow: the victim enters card details; the attacker receives them live and attempts a fraudulent payment elsewhere; the issuer sends a 3-D Secure OTP to the victim; the victim types the OTP into the fake site; the attacker uses it immediately; the victim is shown a fake order confirmation. Because the victim supplies the OTP, MFA is bypassed. The fake login page also forwards email addresses and passwords to the attackers and has no connection to FIFA's account system. (3) Fake live-streaming sites use pages named after real matches with a mock video player that never plays footage. Japanese queries such as 'fifa ワールドカップ 2026 無料配信' were boosted by SEO poisoning, and a compromised website of a US university research institute hosted multiple fake match pages. Victims pass through relay pages on blogging platforms; each click on the fake play button redirects to a different destination, including account-opening pages of trading services and major e-commerce sites (likely unwitting victims of affiliate ad fraud through a malicious ad network). Some pages demand 'registration' that harvests personal and card data or enrolls victims in recurring subscriptions.

Corroborating reporting: FBI IC3 PSA I-052726-PSA (27 May 2026) lists 36 spoofed FIFA domains (ticket, hospitality, store and fake FIFA job/career sites) and expects more. Group-IB's GHOST STADIUM report (27 May 2026) describes a separate, Chinese-speaking financially motivated cluster running a React-based fifa.com clone kit that replicates FIFA's PingIdentity SSO flow with the real client_id, across 300+ active domains out of 4,300+ FIFA-themed domains registered since August 2025 (about 3,800 parked), with Facebook ads as the main traffic source and multiple payment rails. The Hacker News (5 June 2026) summarises related activity including fake streaming apps delivering Android banking trojans and infostealer logs containing FIFA logins. These reports are context for the same lure theme; the Trend source does not attribute its 35,538 sites to GHOST STADIUM or any named actor, so attribution here is Unknown.

Defender relevance: block and monitor FIFA/worldcup lookalike domains and TLD variants, brand-protection takedowns (registrar and CDN abuse channels), user awareness (buy only via fifa.com, verify merchant and amount in 3-D Secure OTP SMS), and issuer-side fraud monitoring for card-not-present transactions and OTP use shortly after card entry.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1608.006 Stage Capabilities: SEO Poisoning
- T1583.008 Acquire Infrastructure: Malvertising
- T1684.001 Impersonation
- T1204.001 User Execution: Malicious Link
- T1056.003 Input Capture: Web Portal Capture
- T1111 Multi-Factor Authentication Interception
- T1056.003 Input Capture: Web Portal Capture
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**FIFA World Cup Lookalike Domain DNS Resolution (Scored)** (`TL-2026-5821-SPL-001`)

TL-2026-5821 (2026 FIFA World Cup scam wave). Scores Sysmon DNS queries (EventCode 22) for FIFA/World Cup lookalike, typosquat and scam domains. Fires on FBI IC3 / Group-IB listed domains (fifa-ticket.live, fifa-tickets.vip, wvvw-fifa.com, fifa-com.com, fifa.city and others), on typosquat patterns of www.fifa.com, and on brand keywords combined with ticket/shop/stream/career lures while excluding official fifa.com, fifa.org and fifaplus.com. Resolution of such a domain is the first observable step of the cloned ticket-site, fake-shop and fake-streaming flows that harvest card data and 3-D Secure OTPs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1656, T1583.001, T1204.001
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=22, Microsoft Sentinel DnsEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h
| eval qname=lower(QueryName)
| eval ioc_hit=if(match(qname,"fifa-ticket[.]live|fifaworldcup26[.]sale|worldcup26ticket[.]com|2026fifaworldcuptickets[.]online|worldcup2026-tickets[.]com[.]mx|fifa-2026[.]xyz|filfa[.]org|wvvw-fifa[.]com|ww-fifa[.]com|fifa-com[.]com|fifa-online[.]com|fifa[.]city|fifa[.]cab|jobs-fifa[.]com|fifa-hiring[.]com|fifaworldcup-careers[.]com|fifa-tickets[.]vip|fifa-com[.]shop|www-fifa[.]com|wc26-fifa[.]com|fifa2026tickets-streamlive[.]com|mm-fifa[.]top|football-ticket[.]top|football-ticket[.]shop|football-game[.]shop|football-tickets[.]top"),1,0)
| eval brand_kw=if(match(qname,"(fifa|worldcup|world-cup|wc26)"),1,0)
| eval legit=if(match(qname,"(^|[.])(fifa[.]com|fifa[.]org|fifaplus[.]com)$"),1,0)
| where ioc_hit=1 OR (brand_kw=1 AND legit=0)
| eval kit_pattern=if(match(qname,"wvvw-fifa|ww-fifa|www-fifa|fifa-com|filfa[.]org|wc26-fifa|fifa-tickets|fifa-online|fifa[.]city|fifa[.]cab|fifa-2026"),1,0)
| eval lure_kw=if(match(qname,"ticket|hospitality|stream|live|shop|store|jersey|sale|career|hiring|jobs"),1,0)
| eval risk=ioc_hit*3+kit_pattern*2+lure_kw+brand_kw
| where risk>=2
| stats count as queries dc(qname) as distinct_domains values(qname) as domains max(risk) as max_risk min(_time) as first_seen max(_time) as last_seen values(Image) as processes by host, User
| convert ctime(first_seen) ctime(last_seen)
| sort - max_risk
```

### Microsoft KQL

```kql
let ioc_domains = dynamic(['fifa-ticket.live','fifaworldcup26.sale','worldcup26ticket.com','2026fifaworldcuptickets.online','worldcup2026-tickets.com.mx','fifa-2026.xyz','filfa.org','wvvw-fifa.com','ww-fifa.com','fifa-com.com','fifa-online.com','fifa.city','fifa.cab','jobs-fifa.com','fifa-hiring.com','fifaworldcup-careers.com','fifa-tickets.vip','fifa-com.shop','www-fifa.com','wc26-fifa.com','fifa2026tickets-streamlive.com','mm-fifa.top','football-ticket.top','football-ticket.shop','football-game.shop','football-tickets.top']);
DnsEvents
| where TimeGenerated > ago(24h)
| where isnotempty(Name)
| extend qname = tolower(Name)
| extend ioc_hit = iff(qname contains_any (ioc_domains), 3, 0)
| extend brand_kw = iff(qname matches regex 'fifa|worldcup|world-cup|wc26', 1, 0)
| extend legit = qname matches regex '(^|[.])(fifa[.]com|fifa[.]org|fifaplus[.]com)$'
| where ioc_hit > 0 or (brand_kw > 0 and not(legit))
| extend kit_pattern = iff(qname matches regex 'wvvw-fifa|ww-fifa|www-fifa|fifa-com|filfa[.]org|wc26-fifa|fifa-tickets|fifa-online|fifa[.]city|fifa[.]cab|fifa-2026', 2, 0)
| extend lure_kw = iff(qname matches regex 'ticket|hospitality|stream|live|shop|store|jersey|sale|career|hiring|jobs', 1, 0)
| extend risk = ioc_hit + kit_pattern + lure_kw + brand_kw
| where risk >= 2
| summarize Queries = count(), Domains = make_set(qname, 25), MaxRisk = max(risk), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ClientIP
| order by MaxRisk desc
```

### Sigma

```yaml
title: FIFA World Cup Lookalike Domain DNS Query (TL-2026-5821)
id: 6f1d2a3e-5b7c-4e18-9a4d-1c2b3d4e5f01
status: experimental
description: Detects DNS queries for FIFA and World Cup lookalike, typosquat and scam domains listed by the FBI IC3 and Group-IB that impersonate official FIFA ticket, hospitality, shop and streaming sites.
references:
  - https://www.ic3.gov/PSA/2026/PSA260527
  - https://www.trendmicro.com/en_us/research/26/g/tracking-fake-sites-in-the-2026-world-cup-scam-wave.html
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.resource-development
  - attack.t1583.001
  - attack.defense-evasion
  - attack.t1656
  - attack.execution
  - attack.t1204.001
logsource:
  category: dns
detection:
  selection_ioc:
    query|contains: ['fifa-ticket.live','fifaworldcup26.sale','worldcup26ticket.com','2026fifaworldcuptickets.online','worldcup2026-tickets.com.mx','fifa-2026.xyz','filfa.org','wvvw-fifa.com','ww-fifa.com','fifa-com.com','fifa-online.com','fifa.city','fifa.cab','jobs-fifa.com','fifa-hiring.com','fifaworldcup-careers.com','fifa-tickets.vip','fifa-com.shop','www-fifa.com','wc26-fifa.com','fifa2026tickets-streamlive.com','mm-fifa.top','football-ticket.top','football-ticket.shop','football-game.shop','football-tickets.top']
  selection_kit:
    query|contains: ['wvvw-fifa','ww-fifa','www-fifa','fifa-com','filfa.org','wc26-fifa','fifa-tickets','fifa-online','fifa-2026']
  selection_brand:
    query|contains: ['fifa','worldcup','world-cup','wc26']
  selection_lure:
    query|contains: ['ticket','hospitality','stream','live','shop','store','jersey','sale','career','hiring','jobs']
  filter_legit:
    - query|endswith: ['.fifa.com','.fifa.org','.fifaplus.com']
    - query: ['fifa.com','fifa.org','fifaplus.com']
  condition: (selection_ioc or selection_kit or (selection_brand and selection_lure)) and not filter_legit
falsepositives:
  - Brand protection or threat intelligence teams resolving lookalike domains
  - Legitimate FIFA partner or fan sites not on the allow list
level: high
```

**Known false positives:**

- Brand-protection, SOC or threat-intel staff deliberately resolving lookalike domains for analysis
- Legitimate FIFA partner, sponsor, broadcaster or fan sites containing the fifa/worldcup keyword that are not on the allow list

**Tuning notes:** Add confirmed official FIFA, partner and broadcaster domains to the legit regex. Raise the risk threshold to 3 in noisy environments to alert only on IOC or typosquat-pattern hits. Refresh the IOC list from the FBI IC3 PSA and Group-IB reporting; the list is a point-in-time snapshot.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- FIFA Lookalike URL Clicked from Email or Teams (Defender for Office 365) (locked: unlock with TL Creds)
- Fake FIFA Live-Streaming Site Visit from Browser (SEO Poisoning Lure) (locked: unlock with TL Creds)
- GHOST STADIUM Kit Fingerprint - Tawk.to Property and Meta Pixel in Web Traffic (locked: unlock with TL Creds)
- FIFA Ticket, Shop or Pay Lookalike Host in Web Proxy Traffic (locked: unlock with TL Creds)
- Fake FIFA Job and Careers Site DNS Lookup (locked: unlock with TL Creds)
- FIFA Scam Redirector Domains and Community-Observed Sibling Infrastructure (DNS) (locked: unlock with TL Creds)
- Cloned FIFA Ticket Site Login and Card Capture Paths via Web Proxy (locked: unlock with TL Creds)
- FIFA Scam Hosting IPs and Payment Rail Contact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 33)

Defanged, TLP:CLEAR.

- IP address: `43.98.183[.]110`
- Domain: `fifa-ticket[.]live`
- File hash: `3b8bb7631b39f455d31544b55ba97b49ab1888c1`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave (TrendAI / Trend Micro)](https://www.trendmicro.com/en_us/research/26/g/tracking-fake-sites-in-the-2026-world-cup-scam-wave.html)
- [FBI IC3 PSA I-052726-PSA: Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup](https://www.ic3.gov/PSA/2026/PSA260527)
- [GHOST STADIUM (Group-IB)](https://www.group-ib.com/blog/ghost-stadium/)
- [FIFA World Cup 2026 Scams Are Already Live (The Hacker News)](https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html)
- [A single typo could derail your World Cup plans (Help Net Security)](https://www.helpnetsecurity.com/2026/05/28/2026-fifa-world-cup-scams/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5821