Ahead of the 2026 FIFA World Cup, ORION, Planet Nine’s AI-powered platform for detecting malicious domains at registration time, identified 8,832 FIFA-themed domains registered in May 2026 alone.
The analysis revealed a broad ecosystem of World Cup-related abuse, including fake ticketing sites, betting networks, recruitment-themed impersonation, lookalike domains, and large amounts of inactive or under-construction registrations.
Nearly 60% of the domains were still dormant or lacked enough visible signals for confident classification. This highlights a key risk around major global events: malicious infrastructure is often built before public attention peaks, leaving only a short window between activation and victim impact.
The full report breaks down the scam patterns ORION uncovered, the types of FIFA-themed domains appearing ahead of the tournament, and why detecting suspicious infrastructure at registration time is critical, especially ahead of major global events.
