Operation FanTrap Tracks FIFA 2026 Fraud Network With Nearly 4,000 Domains
Summary
Cyble’s CRIL investigation describes nearly 4,000 FIFA-themed domains linked to ticket and VIP scams, phishing, and streaming lures, plus fraud conducted through messaging platforms. Football-sector identity leak claims remain unverified.
Key points
- CRIL reports identifying nearly 4,000 FIFA-themed domains since May 2026, spanning phishing, ticket scams, VIP access fraud, brand impersonation, and streaming lures.
- Domain patterns including zh- and cn- prefixes indicate a strong focus on Chinese-speaking audiences; the report also identifies Korean and Latin American fans as target demographics.
- The investigation describes Telegram and WhatsApp as channels used to move prospective victims from public-facing offers into private ticket-sale and payment workflows.
- The report says some pirated streaming sites use fake players, deceptive downloads, notification prompts, and free-trial offers to collect credentials and payment details.
- CRIL observed forum claims about football-sector identity data, including an alleged leak of records relating to more than 150,000 people; the claims have not been independently verified.
- Recommended defenses include monitoring lookalike domains, extending fraud awareness to messaging channels, and using takedown workflows and fan advisories.
Article Details
- Attack Vectors
- FIFA-themed domains impersonate ticketing, VIP access, hospitality, streaming, and official fan services to attract victims.
- Fake ticket, VIP, and streaming offers direct victims to phishing or purchase portals that collect credentials, payment details, and personal information.
- Telegram and WhatsApp are used to move prospective buyers from public-facing sites or communities into private transaction and fraud workflows.
- Pirated streaming sites use deceptive players, download prompts, browser notifications, and free-trial offers as potential credential- and payment-harvesting lures.
- Forum discussions advertised ticket resales and made unverified sellers appear credible through fabricated testimonials, purchase confirmations, and recycled ticket images.
- Dark web posts claimed that football-sector passport and identity records had been leaked; CRIL said the claims require independent forensic verification.
- Defensive Notes
- Monitor for FIFA and tournament-related terms combined with language prefixes such as zh-, cn-, and kr-, and assess registrar, TLD, and domain-age signals.
- Build domain takedown workflows that identify and contact the underlying origin when infrastructure is proxied through Cloudflare.
- Pivot threat hunting from confirmed IOCs using shared IP subnets and registrar concentration.
- Extend fraud monitoring beyond websites to Telegram and WhatsApp channels used to complete off-platform transactions.
- Advise fans that legitimate ticket transactions will not be negotiated through private messaging apps or unverified resale portals.
- Teach users to inspect the registered domain and recognize lookalike domains that place official terminology in subdomains or hyphenated strings.
- Monitor dark web forums for football-sector data-leak claims and treat exposed passport or contract data as a potential social-engineering risk, while verifying claims before treating a breach as confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cctv-maiqiu-fifa-wc[.]com | Example domain in a FIFA-themed pattern categorized as ticketing or streaming fraud. |
| DOMAIN | cctv-maiqiu-fifa[.]com | Example domain in a FIFA-themed pattern categorized as Chinese ticket-buying fraud. |
| DOMAIN | chn-maiqiu-fifa-worldcup[.]com | Example domain in a FIFA-themed pattern categorized as Chinese ticket-buying fraud. |
| DOMAIN | cn-setting-fifa[.]com | Example lookalike domain in a FIFA-themed pattern categorized as Chinese-language credential or VPN phishing. |
| DOMAIN | cn-vpn-fifa[.]com | Example lookalike domain in a FIFA-themed pattern categorized as Chinese-language credential or VPN phishing. |
| DOMAIN | epicsports[.]in | Identified during CRIL monitoring as a pirate-streaming lure; the article describes such sites as potential credential- and payment-fraud funnels. |
| DOMAIN | fifa-ticket-26[.]com | Example domain in a FIFA-themed ticket-scam pattern. |
| DOMAIN | fifa-vip-huya[.]com | Example domain in a FIFA-themed pattern categorized as VIP or premium-access fraud. |
| DOMAIN | fifa-vip-wcplay[.]com | Example domain in a FIFA-themed pattern categorized as VIP or premium-access fraud. |
| DOMAIN | footballnewslive[.]online | Identified during CRIL monitoring as a pirate-streaming lure; the article describes such sites as potential credential- and payment-fraud funnels. |
| DOMAIN | footybite[.]vc | Identified during CRIL monitoring as a pirate-streaming lure; the article describes such sites as potential credential- and payment-fraud funnels. |
| DOMAIN | official-2026-fifa[.]com | Example domain in a FIFA-themed pattern categorized as official-brand impersonation. |
| DOMAIN | official-live-fifa[.]com | Example domain in a FIFA-themed pattern categorized as official-brand impersonation. |
| DOMAIN | play-worldcup-fifa[.]com | Example domain in a FIFA-themed pattern categorized as brand impersonation. |
| DOMAIN | sportshub[.]fan | Identified during CRIL monitoring as a pirate-streaming lure; the article describes such sites as potential credential- and payment-fraud funnels. |
| DOMAIN | ssl-cn-fifa-wc[.]com | Example domain in a FIFA-themed pattern categorized as ticketing or streaming fraud. |
| DOMAIN | streameast[.]im | Identified during CRIL monitoring as a pirate-streaming lure; the article describes such sites as potential credential- and payment-fraud funnels. |
| DOMAIN | totalsportek[.]online | Identified during CRIL monitoring as a pirate-streaming lure; the article describes such sites as potential credential- and payment-fraud funnels. |
| DOMAIN | vip-live-fifa[.]com | Example domain in a FIFA-themed pattern categorized as pirate streaming. |
| DOMAIN | vip-worldcup-fifa[.]com | Example domain in a FIFA-themed pattern categorized as brand impersonation. |
| DOMAIN | web-live-fifa[.]com | Example domain in a FIFA-themed pattern categorized as pirate streaming. |
| DOMAIN | zh-nowlive-fifa[.]com | Example domain in a FIFA-themed fraud pattern categorized by CRIL as Chinese-language phishing or streaming infrastructure. |
| DOMAIN | zh-worldcuphub-fifa[.]com | Example domain in a FIFA-themed fraud pattern categorized by CRIL as Chinese-language phishing or streaming infrastructure. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureFake login and purchase portals were described as collecting credentials and payment information.T1102 · Web ServiceTelegram and WhatsApp were used as web-based services for private fraud communications and off-site transaction workflows.T1566.002 · Spearphishing LinkVictims were lured through links associated with fake ticket offers, VIP access schemes, and unauthorized streaming platforms.T1583.001 · DomainsCRIL reported registration of FIFA-themed domains to create fraudulent infrastructure and impersonate official services.T1583.006 · Web ServicesThe article describes online assets and hosted portals used for fake ticketing, hospitality, and streaming lures.T1585.001 · Social Media AccountsThe article identifies social and messaging channels used to promote scams and move victims into private contact flows.T1657 · Financial TheftThe reported fraud ecosystem monetized victims through fraudulent payments, ticket-resale scams, and abuse of collected data.