Threat video1:00
2026 FIFA World Cup Scam Wave: Detection & IOCs
Cloned ticket sites run real-time phishing for card details and OTPs. 9 detection rules, 33 IOCs, 8 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for 2026 FIFA World Cup Scam Wave: Detection & IOCs →
Chapters
- 0:00The hookWorld Cup scam wave: 35,538 suspicious sites.
- 0:06The storyClones of FIFA's ticket site.
- 0:12Attack pathScammers register lookalike domains and redirectors.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise30 indicators to hunt: 5 IPs, 24 domains and 1 SHA-1 hash.
- 0:39MITRE ATT&CK techniques8 ATT&CK techniques, from resource development to impact.
- 0:44Remediation4 steps now: Block and monitor lookalike domains containing 'fifa' or 'worldcup'.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00World Cup scam wave: 35,538 suspicious sites.
0:06Clones of FIFA's ticket site.
0:08Victims type the OTP; MFA is bypassed.
0:13Scammers register lookalike domains and redirectors.
0:16Clone ticket sites copy FIFA's hospitality site.
0:20Victims enter card details; the attacker gets them live.
0:24The victim sees a fake order.
0:28No threat actor is attributed. Confidence: low.
0:3230 indicators to hunt: 5 IPs, 24 domains and 1 SHA-1 hash.
0:398 ATT&CK techniques, from resource development to impact.
0:444 steps now: Block and monitor lookalike domains containing 'fifa' or 'worldcup'.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.