InfoSecBulletin Cybersecurity for mankind
The amount of phishing aimed at the 2026 FIFA World Cup has grown a lot. New studies show that the threats are bigger and more complicated than first thought.
What started as 79 bad domains has now turned into a widespread phishing network with 222 domains linked to 203 different IP addresses. This is almost three times the number of domains and has increased the hosting setup by over 14 times.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
A follow-up study using passive DNS data, certificate transparency logs, and WHOIS checks shows that 206 out of 222 identified domains are still active.
52 new websites were signed up from April 1 to April 17, 2026. This shows that the campaign is speeding up as the tournament gets closer instead of slowing down.
Many different threat actors are using the same phishing kits that look like FIFA’s official platforms.
Flare says the system is spread out, using 203 different IP addresses. About 80.6% of these sites go through Cloudflare, letting attackers hide where the servers really are by using reverse proxy services. This makes it much harder to shut them down and find out who is behind it.
A smaller subset of IPs hosts multiple phishing domains, including:
38.246.249.74 hosting 8 domains.
154.39.81.213 hosting 6 domains.
148.178.16.48 hosting 5 domains.
The expanded dataset includes 26 registrars, though a few dominate:
GNAME.COM accounts for 42.3% of domains.
GoDaddy follows with 18.9%.
Others include Spaceship, WebNIC, and Alibaba Cloud.
The focus shows that working together to take down important registrars could greatly stop the campaign.
Cloudflare has marked many websites as phishing sites, like fifa-com.store and fifa-com.site, showing warning pages instead of harmful content. But, this is just a tiny part of the whole system, showing the limits of checking each domain one by one.
This campaign shows how big events like the FIFA World Cup offer money-making chances for cybercriminals. With tools for phishing, shared networks, and tricks to hide identities, attackers can grow their actions quickly while avoiding regular defenses.
