Group-IB Maps GHOST STADIUM’s FIFA 2026 Phishing Infrastructure
Summary
Group-IB describes GHOST STADIUM, a financially motivated phishing operation using a fake FIFA site and more than 300 domains. DNS analysis linked typosquatting, WHOIS and IP infrastructure; researchers estimate premium-ticket fraud could cause US$71–474 million in loss
Key points
- Group-IB identified GHOST STADIUM as a Chinese-speaking, financially motivated phishing operation targeting the 2026 FIFA World Cup.
- The campaign used a close replica of FIFA’s website, including a replicated single sign-on flow and multilingual support.
- After filtering likely legitimate or inactive indicators, Group-IB analyzed 33 domains and 14 IP addresses from the campaign’s network indicators.
- Fourteen domains appeared in seven typosquatting groups, which researchers said could indicate shared threat infrastructure.
- Historical WHOIS records yielded 28 unique email addresses; reverse WHOIS queries connected 11 public addresses to 3,083 additional domains.
- Network telemetry showed 607 unique IP addresses, potentially belonging to victims, communicating with 13 of the IP indicators.
- Group-IB estimated potential premium-ticket fraud losses of US$71–474 million; this is a projected risk, not reported actual losses.
Article Details
- Attack Vectors
- Phishing campaign using a pixel-perfect clone of the official FIFA website, including a replicated single sign-on authentication flow and multilingual support.
- More than 300 domains were used in the campaign; Group-IB reported that some used FIFA-related typosquatting and lookalike names.
- Defensive Notes
- Group-IB recommends supplementary investigation to corroborate entities identified as threats, noting that some may later be deemed harmless.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fifa-com[.]co | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| DOMAIN | fifa-com[.]com | Listed as a domain IoC in the same FIFA-related typosquatting group as fifa-com[.]site. |
| DOMAIN | fifa-com[.]site | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| DOMAIN | fifa-com[.]store | Listed as a domain IoC in the same FIFA-related typosquatting group as fifa-com[.]site. |
| DOMAIN | fifa-com[.]vip | Listed as a domain IoC in the same FIFA-related typosquatting group as fifa-com[.]site. |
| DOMAIN | fifa-com[.]website | Listed as a domain IoC in the same FIFA-related typosquatting group as fifa-com[.]site. |
| DOMAIN | fifa-com[.]xyz | Listed as a domain IoC in the same FIFA-related typosquatting group as fifa-com[.]site. |
| DOMAIN | fifa[.]bio | Listed as a domain IoC in the GHOST STADIUM investigation. |
| DOMAIN | fifa[.]cash | Listed as a domain IoC in the GHOST STADIUM investigation. |
| DOMAIN | fifa[.]center | Identified as a domain IoC; Group-IB reported it was considered likely to turn malicious when registered. |
| DOMAIN | fifa[.]city | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| DOMAIN | fifa[.]gold | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| DOMAIN | fifa[.]market | Listed as a domain IoC in the GHOST STADIUM investigation. |
| DOMAIN | fifa[.]show | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| DOMAIN | fifaweb[.]com | Listed as a domain IoC in the GHOST STADIUM investigation. |
| DOMAIN | www-fifa[.]co | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| DOMAIN | www-fifa[.]com[.]co | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| DOMAIN | www-fifa[.]me | Listed as a GHOST STADIUM domain IoC in a FIFA-related typosquatting group. |
| IPV4 | 104[.]225[.]235[.]49 | Listed as a GHOST STADIUM network IP IoC; the article reports historical IP-to-domain resolutions for it. |
| IPV4 | 137[.]220[.]224[.]67 | Listed as a GHOST STADIUM network IP IoC; the article reports historical IP-to-domain resolutions for it. |
| IPV4 | 65[.]49[.]223[.]138 | Listed as a GHOST STADIUM network IP IoC; the article reports historical IP-to-domain resolutions for it. |
| IPV4 | 66[.]112[.]212[.]25 | Listed as a GHOST STADIUM network IP IoC; the article reports historical IP-to-domain resolutions for it. |
| IPV4 | 89[.]208[.]250[.]38 | Listed as a GHOST STADIUM network IP IoC; the article reports historical IP-to-domain resolutions for it. |
MITRE ATT&CK
T1036 · MasqueradingThe listed lookalike domains, including fifa-com[.]site and www-fifa[.]com[.]co, used FIFA-related names.T1566 · PhishingGroup-IB described a phishing campaign that used a fake FIFA website and replicated login flow to lure victims.T1583 · Acquire InfrastructureThe operation used more than 300 domains, including domains in FIFA-related typosquatting groups.
Threat Actors
Tools
Bulk IP Geolocation LookupOur Bulk IP Geolocation Lookup results for the IP IoCs showed that:DNS Chronicle APIWe then queried the domain IoCs on DNS Chronicle API and discovered that 31 of them recorded 1,508 historical domain-to-IP resolutions over time.Reverse WHOIS APIReverse WHOIS API queries for the public email addresses showed that 11 had connections.Typosquatting APIFirst, we queried the domain IoCs on Typosquatting API and discovered that 14 of them appeared in seven typosquatting groups with 3—8 members each bulk-registered between 18 May 2022 and 25 March 2026.WHOIS APINext, we queried the domain IoCs on WHOIS API and found out that:WHOIS History APIWe started our search for potentially connected artifacts by querying the domain IoCs on WHOIS History API.WhoisXML API MCP ServerWe weeded out the domain IoCs deemed to be likely legitimate or inactive by our tools after querying them on the WhoisXML API MCP Server.