More than 75 lookalike domains sell fake 2026 World Cup tickets

Threat actors routinely build fraud campaigns around major events, and the 2026 World Cup is no exception. A researcher at Flare has summarised the consumer fraud infrastructure set up in recent weeks. Among the findings are more than 75 lookalike domains imitating legitimate sites and selling fake tickets and merchandise.

What this means for your organisation

This is consumer fraud, but it reaches the organisation in two ways. Staff shop from work machines and may hand over card details and passwords that are reused elsewhere. And for organisations using the tournament in client or staff events, there is a real risk of buying from a fraudster and having to explain it afterwards. Campaigns tied to major events also give attackers a natural pretext for targeted phishing inside the company.

Berigo recommends

• Remind staff that tickets are bought from the official organiser or a known reseller, never through a link in an advert or message.
• Route ticket purchases for client or staff events through procurement with normal supplier checks.
• Monitor for domains resembling your own, since fraudsters exploit recognised brand names in these campaigns too.
• Apply extra scrutiny to email and messages with World Cup themes in the weeks around the tournament.

Source

• flare.io