A new report out today from Corporation Service Co. finds that third-party registrations of domains containing “FIFA” have surged in the buildup to the 2026 World Cup, with many of them staged for fraud against fans.

CSC’s analysts found 65,590 domains containing the term “FIFA” registered between Jan. 1, 2022, and April 21 this year, none by FIFA itself.

FIFA, the Fédération Internationale de Football Association, is soccer’s world governing body. The 2026 World Cup begins next month in the U.S., Mexico and Canada.

The report notes that registrations typically climb ahead of events on FIFA’s calendar. They climbed for the 2022 Qatar World Cup, during the 2023 Club World Cup and they have been climbing ahead of the 2026 World Cup.

A narrower slice of the data covering domains containing “FIFA tickets” returned only 163 registrations over the same period, but CSC said those carry disproportionate risk. Ticket-focused domains spike around schedule announcements and sales windows and are aimed directly at fans acting with urgency, making them more effective vehicles for fraud than broader keyword domains.

CSC said its researchers have already identified several categories of malicious activity tied to FIFA-themed registrations, including fake ticket sales platforms, travel and accommodation scams, fraudulent merchandise sites, streaming and media scams and giveaway and lottery schemes. Many of the sites mimic official FIFA branding, language and design to appear affiliated with the tournament. Some are activated quickly after registration, while others stay dormant until a key moment, such as the opening of ticket sales.

Not every flagged domain is actively malicious. CSC said registrations fall along a spectrum that runs from parked domains redirecting traffic to ads to unauthorized use of trademarks for monetization to clearly fraudulent infrastructure aimed at capturing personal and payment information.

“These registrations are not owned by FIFA, yet many are designed to capitalize on the visibility, trust and global interest surrounding the tournament,” Fernando Cevallos, director of technology for fraud protection at CSC, wrote in the report. “While some may appear harmless at first glance, others are clearly linked to fraudulent activity.”

CSC expects more of the same through the tournament itself. Ticketing announcements, travel bookings, sponsor pushes and June’s opening match are all likely to bring fresh bursts of registrations. CSC does say that the pattern is not specific to FIFA, as any brand with high public visibility and event-driven attention is exposed to the same lookalike and keyword-based domain activity, with potential consequences ranging from customer confusion to direct financial harm.

Corporation Service Co. is the parent of CSC Corporate Domains Inc. and is one of the largest enterprise domain registrars globally, managing more than 2 million domains for corporate clients.

Image: SiliconANGLE/Ideogram