World Cup Phishing Campaign Nearly Triples With 203 Unique IP

A large-scale phishing campaign targeting the 2026 FIFA World Cup has expanded dramatically, now nearly tripling in size compared to initial assessments. What security researchers first identified as 79 fraudulent domains has since evolved into a sprawling network of at least 222 domains, distributed across 203 unique IP addresses. This significant escalation is detailed in a <

The campaign is built to deceive. Threat actors have constructed convincing replicas of the official FIFA website, complete with fake ticketing pages, copycat stores, and fraudulent login pages that silently accept any credentials entered by users.

The goal is clear: steal payments and harvest account details from football fans eager to attend the tournament.

Researchers at Flare said in a report shared with Cyber Security News (CSN) that they identified the full scale of the operation after expanding their investigation using passive DNS records, certificate transparency logs, and WHOIS data enrichment.

What they uncovered was not a single coordinated attack but a distributed fraud ecosystem with at least four distinct operator clusters all targeting the same event.

The campaign is not slowing down. In just the first 17 days of April 2026, 52 new domains were registered, with fresh additions appearing almost daily. Three dates alone, March 27, March 28, and November 17, 2025, accounted for over 36 percent of all domain registrations in the dataset.

With the tournament approaching fast, the infrastructure keeps growing. Security teams and fans alike are being urged to stay alert, as the fraud operation shows every sign of accelerating rather than winding down ahead of kickoff.

World Cup Phishing Campaign

The original investigation identified 79 typosquatting domains hosted across just 14 IP addresses. The expanded dataset now confirms 222 domains, of which 206 are currently active, resolving to 203 unique IP addresses.

That is roughly 2.8 times the domain count and over 14 times the hosting footprint from the first report. A striking 80.6 percent of those IPs sit behind Cloudflare, which researchers say the operators are using as a reverse proxy to hide their real servers.

Five IP addresses were found hosting multiple domains from the campaign, with the top address alone tied to eight separate fraudulent sites. Cloudflare has also flagged three domains in the dataset as suspected phishing pages, offering independent confirmation that the activity is malicious.

The registrar picture has expanded as well. GNAME.COM remains the dominant registrar, accounting for roughly 94 domains, or about 42 percent of the known infrastructure.

GoDaddy follows with 42 domains, meaning just two registrars control around 61 percent of the total. Researchers recommend brand protection teams prioritize bulk abuse reporting to these two as the fastest path to removing the largest share of the network.

Four Distinct Operator Clusters Behind the Fraud

One of the most revealing findings is that this is not a single, centrally run operation. Analysis shows at least four separate operator clusters with different registration patterns, hosting choices, and digital fingerprints.

Cluster A is the most visible, running roughly 86 domains that directly mimic the fifa.com address. Cluster B is harder to detect, operating 14 .shop domains with generic-sounding names that show no FIFA connection yet serve the same fraudulent landing page.

Cluster C is a smaller group of three .cn domains registered through a single Gmail address, pointing toward a China-based actor working independently. Cluster D uses a fake registrant identity, “888 World Cup Management Co Ltd,” referencing the tournament openly in its cover.

All four clusters share the same page templates and target the same victims, but their fingerprints suggest independent actors exploiting a shared scam kit rather than one coordinated group.

The detection must now operate at the campaign level, not domain by domain. Teams are advised to look beyond naming patterns, incorporate TLS certificate reuse and page template fingerprinting into detection rules, and treat any newly registered domain matching known WHOIS indicators as part of the active campaign.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.