Hackers Register Domains to Target 2026 FIFA World Cup in Cyberattack

A concerning surge in malicious domain registrations is being used to exploit the upcoming 2026 FIFA World Cup, with threat actors positioning themselves more than a year before the tournament begins, according to PreCrime Labs, the threat research division of BforeAI. The comprehensive investigation, conducted in August 2025, analysed 498 suspicious domains containing FIFA, football and World Cup terminology, revealing a sophisticated pre-positioning strategy.

The study, which drew on observations from the FIFA Club World Cup 2025 in the United States, notes that some domains have already been registered for tournaments as far out as 2030 and 2034. A notable spike occurred between 8–12 August 2025, when approximately 299 domains were registered in five days, with popular registrars including GoDaddy[.]com LLC, Namecheap Inc., Gname[.]com Pte. Ltd., Dynadot Inc., and Wix.

Domain analysis shows 173 domains containing “FIFA”, 212 with “football” and 129 using “worldcup”, alongside 23 references to host cities such as Dallas, Atlanta and Philadelphia.