InfoSecBulletin Cybersecurity for mankind
The amount of phishing aimed at the 2026 FIFA World Cup has grown a lot. New studies show that the threats are bigger and more complicated than first thought.
What started as 79 bad domains has now turned into a widespread phishing network with 222 domains linked to 203 different IP addresses. This is almost three times the number of domains and has increased the hosting setup by over 14 times.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
A follow-up study using passive DNS data, certificate transparency logs, and WHOIS checks shows that 206 out of 222 identified domains are still active.
52 new websites were signed up from April 1 to April 17, 2026. This shows that the campaign is speeding up as the tournament gets closer instead of slowing down.
Many different threat actors are using the same phishing kits that look like FIFA’s official platforms.
Flare says the system is spread out, using 203 different IP addresses. About 80.6% of these sites go through Cloudflare, letting attackers hide where the servers really are by using reverse proxy services. This makes it much harder to shut them down and find out who is behind it.
A smaller subset of IPs hosts multiple phishing domains, including:
38.246.249.74 hosting 8 domains.
154.39.81.213 hosting 6 domains.
148.178.16.48 hosting 5 domains.
The expanded dataset includes 26 registrars, though a few dominate:
GNAME.COM accounts for 42.3% of domains.
GoDaddy follows with 18.9%.
Others include Spaceship, WebNIC, and Alibaba Cloud.
The focus shows that working together to take down important registrars could greatly stop the campaign.
Cloudflare has marked many websites as phishing sites, like fifa-com.store and fifa-com.site, showing warning pages instead of harmful content. But, this is just a tiny part of the whole system, showing the limits of checking each domain one by one.
This campaign shows how big events like the FIFA World Cup offer money-making chances for cybercriminals. With tools for phishing, shared networks, and tricks to hide identities, attackers can grow their actions quickly while avoiding regular defenses.
