Cybercriminals have registered more than 4,300 fake FIFA World Cup domains since August 1, 2025, in a coordinated scheme to scam fans and exploit the upcoming 2026 tournament, according to new research from Check Point Research.
The cybersecurity firm said the domains, which spoof FIFA, “World Cup,” and host cities like Dallas, Miami, Toronto, and Mexico City, are part of a large-scale fraud infrastructure aimed at phishing, ticket scams, counterfeit merchandise, and even botnet attacks.
The activity is designed to coincide with FIFA’s official ticketing schedule, which enters a critical phase from September 29 when presale results are announced.
Fraud infrastructure already in place
Check Point’s analysis shows that the domain registrations are not random as they appear in synchronised waves, often using the same DNS setups, and are clustered across registrars such as GoDaddy, Namecheap, Dynadot, and Gname.
According to the report, some websites even reference future tournaments like FIFA 2030 and 2034, a strategy known as “domain aging,” where scammers let domains sit unused to gain credibility over time.
“What we’re seeing is infrastructure being built, at scale, to exploit global interest before the World Cup even kicks off,” said Evangelist at Check Point, Amit Weigman.
“Threat actors are not waiting for 2026; they are matching their timeline to FIFA’s,” Weigman added.
Ticketing fraud in focus
With FIFA’s ticket presale draw concluded on September 19 and purchase windows opening on October 1, Check Point warns that fans are at high risk of targeted scams.
Fraudsters are expected to launch phishing campaigns with spoofed ticket confirmations, fake queue portals, and fraudulent payment pages.
This kind of timing makes scams more convincing since fans will be expecting official FIFA communications during the same period.
The report outlines several indicators of systematic fraud to include:
- 4,300+ FIFA-related domains registered in under 60 days.
- Activity spikes recorded between August 8–12 and early September.
- Registrar concentration enabling bulk automation.
- Targeted languages: English for streaming, Spanish and Portuguese for ticketing and merchandise, French for Europe.
- Top-level domains (.com, .shop, .store, .online, .football) chosen for low cost.
- Centralised DNS overlaps, suggesting coordination by small groups using scripted fraud kits.
Check Point also found evidence of botnets being trained to flood ticketing queues, scoop up inventory, and manipulate dynamic pricing models.
On Telegram channels and dark-web markets, FIFA-themed fraud kits, counterfeit jerseys, and fake hospitality offers are already being promoted.
More insights
Last week, FIFA President, Gianni Infantino, announced that over 4.5 million fans worldwide applied for the first opportunity to purchase tickets for the biggest-ever FIFA World Cup scheduled to take place across North America next June and July.
According to him, the huge interest in the draw confirmed that next year’s tournament in Canada, Mexico and the 🇺🇸 United States will be “the biggest, most inclusive, and most exciting event ever.”
