By Juliet Umeh
Cybersecurity experts have warned that cybercriminals are laying the groundwork for one of the largest fraud schemes ever seen around a sporting event, targeting millions of fans ahead of the FIFA World Cup 2026.
A report by Check Point Research revealed that over 4,300 fake domains linked to FIFA and the World Cup has been registered since August 1, 2025.
The firm explained that these websites mimic FIFA “World Cup,” and even host cities like Dallas, Miami, Toronto and Mexico City.
Evangelist at Check Point, Amit Weigman, said: “These are not random websites. What we are seeing is infrastructure being built, at scale, to exploit global interest before the World Cup even kicks off. Threat actors are not waiting for 2026; they are matching their timeline to FIFA’s.”
“With FIFA ticket presale results due September 29 and official ticket purchases opening October 1, scammers will strike when fans are expecting official communication. That overlap makes phishing attempts extremely convincing,” he said.
The report highlighted that many of the domains were clustered around a few major registrars. The researcher noted: “We found synchronised waves of registration, often across GoDaddy, Namecheap, Dynadot and Gname. Some even reference future tournaments like FIFA 2030 and 2034. This is what we call domain aging, scammers build trust in a site before using it.”
Check Point also disclosed that criminals are preparing to use the websites for fake ticket confirmations, bogus queue portals, counterfeit jerseys and fraudulent hospitality offers.
The report warned: “On Telegram channels and dark-web forums, we are already seeing fraud kits branded with FIFA logos. There are even bots being trained to flood ticketing systems and scoop up inventory. ”
