The FIFA World Cup 2026 is approaching. While the organizers will announce ticket sales on September 29, cybercriminals are quietly preparing a massive attack targeting both fans and organizers. According to the latest report “Playing Offside: How Threat Actors Are Warming Up for FIFA 2026” by Check Point Research, hackers have already built a network of fake domains, botnet systems, and counterfeit ticket sales schemes. Their goal: to trick as many people as possible and maximize financial gain. And Poles love the World Cup — in 2022, over 4,000 fans traveled to Qatar, with many more watching matches on TV and online platforms.
In just the last two months (since August 1, 2025), more than 4,300 new domains containing words like “FIFA,” “World Cup,” or host city names have been registered. Experts warn — “This is the result of an automated and carefully planned bulk purchase of domains aimed at building infrastructure for future hacker fraud campaigns,” said Amit Weigman, Security Evangelist at Check Point Research. These registrations are not random — they occur in synchronized waves. Between August 8–12 alone, nearly 1,500 new addresses appeared, with another spike at the beginning of September.
The scale of the threat is huge and affects multiple stakeholders. Fans are at risk of losing money through fake ticket purchases, data theft via phishing, and malware infections. FIFA and sponsors face reputation damage, brand dilution, and lost revenues from legitimate sales. Host cities could become victims of campaigns exploiting local services such as transport, hotels, and restaurants. Finally, the entire internet ecosystem — from domain registrars and ad networks to social media platforms — could be unknowingly weaponized by criminals. Proper safeguards must be implemented, stressed Wojciech Głażewski, Country Manager of Check Point Software Technologies in Poland.
The main lures for fans are promises of cheaper (fake) tickets, illegal streams, and counterfeit football merchandise. Hackers use domain naming patterns such as fifa2026ticketsmiami.com, and more complex ones like fifa2026tickets-streamlive.com, which suggest the use of phishing page generators based on templates. Streaming scams often feature terms like “HD,” “watch live,” or “free,” designed to trick victims with the promise of free access to matches.
Examples of fake FIFA 2026 domains and sites
The domains are deliberately aligned with host countries (USA, Mexico, Canada) and specific cities such as Dallas, Miami, Toronto, Vancouver, and Mexico City. This is a deliberate strategy to boost search engine rankings and credibility with international fans. Criminals also tailor campaigns by language: English dominates streaming scams, Spanish and Portuguese appear in fake ticket and merchandise sales, and French is used in smaller campaigns aimed at European supporters.
Moreover, criminals show long-term planning — many domains registered now reference not only the 2026 tournament but also the 2030 and 2034 World Cups. They employ a tactic called “domain aging,” leaving domains inactive for years so they gain legitimacy in search engines and among users before being exploited.
The most frequently used registrars include GoDaddy, Namecheap, Gname, Dynadot, and Porkbun — companies known for low prices, simple procedures, and automation options. The most popular extension is .com, but cheap domains like .online, .shop, .store, and .football are also widely used, enabling large-scale fraud at minimal cost.
Multiple Criminal Groups Expected to Target FIFA 2026
DNS infrastructure analysis reveals another concerning detail — many domains share identical name servers, suggesting that the activity is driven not by dozens of independent fraudsters but by a limited number of specialized groups managing large portfolios of domains. Coordinated registrations, similar naming patterns, and recurring infrastructure are typical hallmarks of campaigns run by semi-professional criminal groups.
Fake domains are only one part of the digital fraud ecosystem. On Telegram, there are already channels offering “exclusive tickets” and counterfeit jerseys. Dark web forums serve as marketplaces for fake products as well as phishing and financial fraud tools branded under FIFA. Fake social media accounts impersonate official channels, while search engine ad campaigns can push fraudulent links above FIFA’s official ones.
Hackers Preparing to Auction Genuine Tickets at Inflated Prices
The biggest threat, however, remains the ticketing system. The report highlights active preparations of botnets designed to overwhelm ticketing queues. Their aim is to secure large volumes of tickets and resell them at inflated prices. At the same time, these bots disrupt dynamic pricing algorithms, driving up costs for genuine fans. Entire toolkits are already available on the dark web: bot kits, proxy farms, and even guides for bypassing FIFA’s ticketing protections. The issue is not unique to FIFA — a recent lawsuit by the U.S. Federal Trade Commission (FTC) against Live Nation/Ticketmaster shows that mass automation is distorting ticket markets at other major events too.
The report provides clear recommendations that should be implemented immediately. FIFA and its partners must continuously monitor domain combinations such as “FIFA + year + city” across multiple languages and work with registrars to swiftly take down suspicious addresses. Major registrars like GoDaddy and Namecheap should tighten user verification and abuse response procedures. Monitoring of dark web forums, Telegram, and ad platforms is also necessary to identify fraud distribution channels.
Ticketing systems must immediately deploy advanced bot detection and behavioral analytics, especially during pre-sales and lotteries. Official FIFA channels must be actively promoted in search engines and social media to stay ahead of fraudsters. Equally important is educating fans that the only safe source of tickets is through official organizer websites.
The FIFA World Cup 2026 has the potential to go down in history as an exceptional sporting event — but it could just as easily be remembered as a digital disaster where thousands of fans lost money, data, and trust in the organizers. As the report shows, fraudsters aren’t waiting for the first whistle — their campaign is already underway.
