World Cup Phishing Campaign Nearly Triples With 203 Unique IP Addresses

A large-scale phishing campaign exploiting the 2026 FIFA World Cup has expanded to at least 222 domains (206 active) across 203 IPs and is operated by four distinct clusters; attackers use convincing replicas of FIFA pages, typosquatting, shared scam-kit templates, and Cloudflare reverse proxies to harvest payments and credentials. Researchers expanded the dataset using passive DNS, CT logs, and WHOIS enrichment and supply IoCs (top hosting IPs, registrant emails, TLS cert hashes, and flagged domains), advising bulk abuse reports to dominant registrars and campaign-level detection using TLS and template fingerprinting.