cyber.hendryadrian.com
Threat Research · cloudsek.com

Researchers Detail FIFA World Cup Ticket Phishing Kit That Can Intercept OTPs

· Original article ↗

Summary

CloudSEK reports a multi-tenant operation using FIFA ticket-site clones to harvest card data and potentially relay OTPs. The researchers identified dozens of impersonation domains but could not verify victim totals or financial losses.

Key points

  • The operation uses typosquatted FIFA ticket domains and cloned tournament pages to lure prospective buyers, with traffic reportedly driven mainly through Facebook and Instagram in-app browsers.
  • A backend panel tracks visitors and checkout stages, including card entry and OTP verification; researchers say this supports real-time OTP interception and possible SMS-based 2FA bypass.
  • The payment-card capture system is managed through a Chinese-language platform at admin-zone[.]tbpay[.]uk, which reportedly supports at least 15 operator tenants.
  • Researchers observed a test-card record and operator activity, but could not establish how many real victims were defrauded or how much money was lost.
  • Simplified Chinese interfaces and repeated logins from a China-based IP suggest Chinese operators, but attribution is not conclusive.
  • The article lists phishing domains and infrastructure indicators and advises buying tickets only through FIFA's official website.

Article Details

Attack Vectors
  • FIFA ticket-phishing sites use typosquatted domains and cloned pages that mirror official tournament content.
  • Traffic is driven primarily through Facebook and Instagram in-app browsers; the article reports a coordinated social-media advertising wave.
  • The fake checkout captures payment-card details and tracks victims through product, address, card-entry, and OTP pages.
  • Operators use live-session phishing to relay OTPs and bypass SMS-based two-factor authentication.
  • Embedded live chat is used to support victims during fraudulent interactions.
Defensive Notes
  • Purchase FIFA World Cup 2026 tickets only through the official FIFA website, fifa[.]com.
  • Treat ticket links shared via Facebook or Instagram with caution and scrutinize domains containing variants such as ww-fifa, www-fifa, sdf-26fifa, or tbpay.
  • Financial institutions and card networks are advised to flag card-not-present transactions associated with the listed phishing domains and investigate tbpay[.]uk as suspected rogue payment infrastructure.
  • The article recommends cross-referencing card BIN testing activity associated with 222[.]167[.]244[.]34 against real transactions.

Indicators of compromise

TypeIndicatorContext
DOMAIN1346590[.]comListed in the operation's phishing and typosquatting domain network.
DOMAINaa-fifa[.]shopListed as a FIFA-impersonating phishing domain.
DOMAINadmin-zone[.]tbpay[.]ukFraud-operation administrative panel used to manage tenants and track or intercept victim payment and OTP data.
DOMAINfifa-online[.]comListed as a FIFA-impersonating phishing domain.
DOMAINfifa[.]centerListed as a FIFA-impersonating phishing domain.
DOMAINfifa[.]goldListed as a FIFA-impersonating phishing domain.
DOMAINfifa[.]shoppingListed as a FIFA-impersonating phishing domain.
DOMAINfifa[.]skiListed as a FIFA-impersonating phishing domain.
DOMAINfifaworldcup26[.]saleListed as a FIFA World Cup-impersonating phishing domain.
DOMAINgx-fifa26[.]shopListed as a FIFA-impersonating phishing domain.
DOMAINsdf-26fifa[.]topPhishing domain hosting a clone of the official FIFA website.
DOMAINsite-fifa[.]siteListed as a FIFA-impersonating phishing domain.
DOMAINtbpay[.]siteSibling domain reported as flagged for phishing and suspicious activity.
DOMAINtbpay[.]ukCore payment-interception and management infrastructure for the reported fraud operation.
DOMAINww-fifa[.]comFIFA-impersonating phishing domain linked to the operation's chat property and fake ticket checkout.
DOMAINwww-fifa[.]asiaListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]barListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]bioListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]biz[.]idListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]bondListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]cfdListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]clickListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]clubListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]cyouListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]digitalListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]icuListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]infoListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]lolListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]monsterListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]myListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]my[.]idListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]oneListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]qponListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]sbsListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]web[.]idListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]workListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]xinListed as a FIFA-impersonating phishing domain.
DOMAINwww-fifa[.]xyzListed as a FIFA-impersonating phishing domain.
DOMAINwww[.]fifaworldcup[.]oneListed as a FIFA World Cup-impersonating phishing domain.
DOMAINwz-fifa26[.]shopListed as a FIFA-impersonating phishing domain.
EMAILtickets@fifa-rbi605[.]p[.]tawkto[.]emailSender address associated with the phishing operation's ticket-support chat infrastructure.
HOSTNAMEfifa-rbi605[.]p[.]tawkto[.]emailOperation-linked live-chat subdomain used to provide victim support.
IPV4104[.]225[.]150[.]140Listed in the article's operation-related IP indicators.
IPV4123[.]100[.]137[.]38Listed as an additional operator or scanning IP associated with the operation.
IPV4138[.]199[.]60[.]37Listed in the article's operation-related IP indicators.
IPV4154[.]47[.]30[.]138Listed in the article's operation-related IP indicators.
IPV4156[.]226[.]172[.]223Listed in the article's operation-related IP indicators.
IPV4188[.]253[.]7[.]187Listed in the article's operation-related IP indicators.
IPV4188[.]253[.]7[.]92Listed in the article's operation-related IP indicators.
IPV4197[.]234[.]242[.]86Listed in the article's operation-related IP indicators.
IPV4216[.]126[.]233[.]30Listed in the article's operation-related IP indicators.
IPV4216[.]126[.]233[.]37Listed in the article's operation-related IP indicators.
IPV4222[.]167[.]244[.]34IP repeatedly associated in the article with operator logins and card-skimming administration.
IPV427[.]150[.]251[.]195Listed as an additional operator or scanning IP associated with the operation.
IPV438[.]60[.]195[.]137Reported as a tenant login IP in the fraud reseller platform.
IPV445[.]149[.]172[.]35Listed in the article's operation-related IP indicators.
URLhxxps[:]//admin-zone[.]tbpay[.]uk/users/tenantAdministrative URL for the fraud platform's tenant-management panel.
URLhxxps[:]//sdf-26fifa[.]top/en/tournaments/mens/worldcup/canadamexicousa2026Specific phishing-page URL hosting a clone of the official FIFA tournament site.
URLhxxps[:]//www[.]ww-fifa[.]com/cartSpecific fake ticket-cart URL used by the FIFA-impersonating phishing operation.

MITRE ATT&CK

T1056.003 · Web Portal CaptureThe phishing pages capture payment-card details through simulated checkout forms.T1111 · Multi-Factor Authentication InterceptionThe platform tracks OTP verification pages and is described as relaying victims' OTPs to bypass SMS-based authentication.T1583.001 · DomainsThe operation registers typosquatted domains impersonating FIFA and the World Cup.

Products

FIFA World Cup 2026With the FIFA World Cup 2026 tournament scheduled to begin on June 11, 2026, a highly active, multi-tenant ticket fraud operation has been identified targeting prospective attendees globally.  According to research by

Countries

AustraliaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.AustriaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.CanadaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.Chinaand backend naming conventions suggest the threat actors are based in the People's Republic of China (PRC). The core payment routing hub, tbpay[.]uk, lacks financial regulatory authorization, consistent withGermanyPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.Hong KongPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.ItalyPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.LithuaniaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.PhilippinesPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.RomaniaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.Saudi ArabiaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.South AfricaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.South KoreaPrimarily US-based victims, with secondary hits from: Italy, Romania, Philippines, Sweden, Australia, Lithuania, Canada, South Africa, Austria, Saudi Arabia, Germany, South Korea, Hong Kong.SwedenVictim accessing from SwedenUnited States