Audit log

Every state-changing event for FIFA World Cup 2026 Crypto Scam Infrastructure: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-27 17:31:28Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 429,281,857

   sig

   626mtpoQMkMo…FJyoNAwWcopyexplorer ↗

   hash

   7f3jSWm3gprx…Hy4LFfRecopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (24149 B) ▸

   {"actor":"system:backfill","investigation_id":"d412e380-e3a5-4ad5-88a9-38f072059b80","kind":"publish","page_slug":"fifa-world-cup-2026-crypto-scam-infrastructure","published_at":"2026-06-27T17:31:28.064Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"FIFA World Cup 2026 Crypto Scam Infrastructure","sections":[{"content":"The 2026 FIFA World Cup, held across the United States, Canada, and Mexico from June 11 to July 19, 2026, attracted an estimated 6.5 million in-person attendees and generated a projected $40.9 billion in global economic impact. The scale of the event — with over 150 million ticket requests in the first 15 days of sales and a tournament approximately 30 times oversubscribed — created conditions that cybercriminal networks actively exploited ahead of and during the competition. Multiple independent cybersecurity and law enforcement bodies — including the FBI, TRM Labs, Malwarebytes, FortiGuard Labs, and Group-IB — documented coordinated fraud infrastructure targeting fans across at least five distinct vectors: fake ticketing domains, fan-branded memecoins, social media impersonation, fake streaming sites, and fixed-match betting schemes. FortiGuard Labs identified over 13,000 FIFA-themed domains registered between January and May 2026, with approximately 8.8% classified as malicious or suspicious. A separate Group-IB analysis identified a Chinese-speaking threat actor group, labeled GHOST STADIUM, operating over 300 cloned FIFA sites. An estimated 270,000 or more fan and user credentials from FIFA-related websites were found in malware-collected data, along with over 260 sets of FIFA organizational employee credentials.","heading":"Overview and Threat Scope","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"credibility":2,"name":"FortiGuard Labs: Cybercriminals Are Targeting the FIFA World Cup 2026","type":"research","url":"https://www.fortinet.com/blog/threat-research/cybercriminals-are-targeting-the-fifa-world-cup-2026"},{"credibility":2,"name":"The Hacker News: FIFA World Cup 2026 Scams Are Already Live","type":"news_article","url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"},{"credibility":2,"name":"Coincentral: TRM Labs Warns FIFA Fans as Crypto Scams Hit World Cup","type":"news_article","url":"https://coincentral.com/trm-labs-warns-fifa-fans-as-crypto-scams-hit-world-cup/"}]},{"content":"On May 27, 2026, the FBI Cyber Division issued Public Service Announcement I-052726-PSA through the Internet Crime Complaint Center (IC3), formally warning the public that cyber threat actors were conducting spoofing attacks against FIFA's official website ahead of the 2026 World Cup. The advisory cited typo-squatting as the primary technique: threat actors registered domains featuring alternate spellings, character substitutions, or alternative top-level domains to impersonate www.fifa.com. The FBI enumerated more than 30 specific fraudulent domains, including fifa[.]cab, fifa[.]pink, fifa[.]blue, jobs-fifa[.]com, fifa-ticket[.]live, worldcup2026-tickets.com[.]mx, and fifaworldcup26[.]sale, among others. The stated objectives of these domains were collection of personally identifiable information, sale of fraudulent World Cup tickets and hospitality packages, and facilitation of broader financial fraud. The FBI recommended that users type fifa.com directly into the browser address bar rather than using search engines, and cautioned against clicking sponsored search results. Separately, FortiGuard Labs documented 4,300 or more fraudulent FIFA domains registered since August 2025, with 3,800 or more parked and unused — a common staging pattern in which infrastructure is held ready for rapid deployment. Intel 471 reported approximately 19,000 domains containing FIFA references registered since January 2026. The Los Angeles County Sheriff's Department issued a parallel advisory on June 3, 2026, warning residents specifically about crypto-only payment demands, which it characterized as a fraud signal.","heading":"FBI Advisory and Fake FIFA Domain Network","severity":"critical","sources":[{"credibility":1,"name":"FBI IC3 PSA I-052726-PSA: Threat Actors Spoofing FIFA Websites","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"Cryptopolitan: FBI Alerts FIFA World Cup Fans Crypto Scams","type":"news_article","url":"https://www.cryptopolitan.com/fbi-alerts-fifa-world-cup-fans-crypto-scams/"},{"credibility":2,"name":"Bleeping Computer: FBI Warns of Fake FIFA Websites Running World Cup Fraud Schemes","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-fifa-websites-running-world-cup-fraud-schemes/"},{"credibility":2,"name":"Bitdefender: FBI FIFA Scams 2026 World Cup","type":"research","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-fifa-scams-2026-world-cup"},{"credibility":2,"name":"Help Net Security: Free, No-Signup World Cup Streams Serve Scams","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/23/fake-world-cup-streaming-sites-scams/"}]},{"content":"A token identified as World Cup PvP (ticker: WCUP) launched in June 2026 and was the subject of analysis by blockchain analytics firm Bubblemaps. According to Bubblemaps, over 30 newly created wallets — none with prior on-chain transaction history — were funded from a centralized exchange approximately 30 minutes before the token's public launch. These wallets then collectively acquired an alleged 95% of WCUP's circulating supply within the first minute of trading. Bubblemaps characterized this as a single coordinated entity, employing a Uniswap Router to attempt obfuscation of the supply concentration trail. The 30 initial wallets subsequently distributed tokens to approximately 2,500 additional new addresses. WCUP reached a market capitalization of $50 million on its launch day, with liquidity of only approximately $536,000 against a fully diluted valuation of $65 million — a ratio that analysts noted would cause severe price impact on any significant early-holder liquidation. Bubblemaps stated: \"When a single entity controls 95% of the supply, it effectively controls the price and can dump on retail buyers at any time.\" Additionally, multiple crypto influencers were identified as having been paid to promote WCUP without disclosing that compensation to their followers, according to Bubblemaps' analysis. A separate token, $WORLDCUP, was listed on LBank exchange and marketed as a \"World Cup Commemorative Coin.\" TRM Labs categorized this token as carrying standard pump-and-dump, low-liquidity risks, and noted it had no affiliation with FIFA. Neither WCUP nor $WORLDCUP holds any licensed or official relationship with FIFA or the 2026 tournament.","heading":"WCUP Memecoin: Alleged Insider Concentration and Market Manipulation","severity":"critical","sources":[{"credibility":2,"name":"BitcoinWorld: 95% Of World Cup Token WCUP Supply Pre-Purchased By Single Group, Bubblemaps Alleges","type":"news_article","url":"https://bitcoinworld.co.in/world-cup-token-wcup-scam-bubblemaps/"},{"credibility":2,"name":"CryptoNews.net: 95% of World Cup Token WCUP Supply Pre-Purchased by Single Group","type":"news_article","url":"https://cryptonews.net/news/altcoins/33000264/"},{"credibility":2,"name":"Cryptopolitan: FBI Alerts FIFA World Cup Fans Crypto Scams","type":"news_article","url":"https://www.cryptopolitan.com/fbi-alerts-fifa-world-cup-fans-crypto-scams/"},{"credibility":2,"name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"}]},{"content":"TRM Labs, in a report published June 11, 2026, documented three distinct operational clusters tied to four active cryptocurrency addresses: two fake-ticketing sites and one fixed-match betting scheme. One Polygon-based address received approximately $1,562, nearly all on a single day on April 1, 2026, a pattern TRM characterized as consistent with a short promotional window or rapid domain rotation. A Bitcoin address was also deployed by the same infrastructure but had received no payments at the time of TRM's report. A third Bitcoin address, associated with the fixed-match betting operation, received small payments across multiple days between January and May 2026, with proceeds routed to custodial exchange deposit accounts. TRM noted that, while the amounts documented across these initially identified addresses were modest (under $1,700 combined), the infrastructure and money-movement patterns — including the use of cross-chain bridges routing through Polygon, TRON, and Bitcoin — are consistent with broader consumer crypto fraud typologies. TRM further noted that, as of the time of their report, approximately $1.9 billion in scam-linked funds across all typologies had been moved through cross-chain bridges, reflecting a systemic trend toward bridging as a laundering technique. Malwarebytes separately identified over 40 fake streaming websites using identical structural templates, with different World Cup-themed names, which monetized visitor traffic through ad impression fraud rather than actual streaming delivery — in several documented cases, the promised stream never appeared.","heading":"Fake Ticketing Operations and Blockchain Payment Flows","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"credibility":2,"name":"Bitcoin Foundation: FIFA World Cup Crypto Scams Started Before 2026 Tournament","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/fifa-world-cup-crypto-scams-started-before-2026-tournament-data-shows/"},{"credibility":2,"name":"Help Net Security: Free, No-Signup World Cup Streams Serve Scams","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/23/fake-world-cup-streaming-sites-scams/"},{"credibility":2,"name":"Decrypt: World Cup Crypto Scams Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns"}]},{"content":"Malwarebytes published a threat intelligence report on May 4, 2026, documenting a \"four-part scam economy\" already operational before the tournament began. Among the schemes identified were fraudulent token sale sites marketing their offerings as \"the official community token celebrating the FIFA World Cup 2026.\" One documented site advertised a \"Mega Airdrop\" with a 7-billion-token total supply and displayed a participant counter set to 48 — the count of qualified national teams — to create an appearance of legitimacy. Another site used FIFA's official mascot and tournament branding to sell an unlicensed token. Malwarebytes confirmed that none of these sites carried any affiliation with FIFA. FIFA's actual digital products include the FIFA Collect NFT marketplace, Right-to-Buy ticket NFTs, and the FIFA Rivals game on the Mythos chain, all operated under FIFA-controlled infrastructure at FIFA's own domains. The counterfeit sites were distributed primarily through advertising networks, sponsored search results, and redirect chains. Victims who interacted with these sites risked loss of funds, receipt of worthless assets, or granting wallet access permissions to the scam operators. The promotional path to these sites commonly ran through banner ads on unrelated websites or search engine sponsored links.","heading":"Fake Token Airdrops and Impersonation of FIFA Digital Products","severity":"high","sources":[{"credibility":2,"name":"Malwarebytes: The 2026 World Cup Scam Economy Is Already Running Before the First Whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":2,"name":"Decrypt: World Cup Crypto Scams Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns"}]},{"content":"FortiGuard Labs documented over 1,700 suspected FIFA-related impersonation accounts across social media and messaging platforms, with approximately 90% of activity concentrated on Facebook and Instagram. These accounts were used for fake promotions, phishing, and malware distribution. In stealer logs analyzed by FortiGuard, over 4,600 FIFA-related URLs appeared, associated with the Vidar, LummaC2, and RedLine malware families. Over 260 sets of FIFA organizational employee credentials and over 1,500 FIFA-related employee or organizational accounts were found in historical breach datasets. The total count of fan and user credentials from FIFA-related websites found in malware-collected data exceeded 270,000. Separately, FortiGuard identified an executable file (1xbet.exe) exhibiting persistence behaviors and encrypted communications, as well as suspicious FIFA-themed APK files distributed via third-party download sites — characterized as vehicles for spyware, credential theft, and remote access trojans. Fake job postings impersonating FIFA and its sponsors were also identified, directing applicants to phishing pages mimicking Google login screens. These coordinated campaigns were found to share identical Google Analytics tracking IDs, indicating centralized operation across multiple domains. TRM Labs additionally noted that AI-enabled tools now permit scammers to clone trusted brands and construct pixel-perfect phishing sites at scale, and observed that deepfake athlete and celebrity promotions for crypto giveaways and betting tokens were an active and emerging threat surface during the tournament period.","heading":"Social Media Impersonation, Malware, and Credential Theft","severity":"high","sources":[{"credibility":2,"name":"FortiGuard Labs: Cybercriminals Are Targeting the FIFA World Cup 2026","type":"research","url":"https://www.fortinet.com/blog/threat-research/cybercriminals-are-targeting-the-fifa-world-cup-2026"},{"credibility":2,"name":"The Hacker News: FIFA World Cup 2026 Scams Are Already Live","type":"news_article","url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"},{"credibility":2,"name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"}]},{"content":"The FBI IC3 advisory (I-052726-PSA, May 27, 2026) recommended that fans type fifa.com directly into their browser address bar and avoid using search engines to navigate to FIFA properties, verify that URLs end in .com and match FIFA's official domain, avoid all sponsored links in search results, and bookmark trusted sites used for login. Victims of fraud were directed to file complaints at ic3.gov with domain information, interaction records, and financial transaction details. The Los Angeles County Sheriff's Department on June 3, 2026 advised treating any request for crypto-only payment as a fraud signal, and cautioned against accepting screenshots, PDFs, or paper tickets from private sellers. TRM Labs recommended using only official FIFA ticketing channels and contacting ic3.gov, local law enforcement, and the relevant financial institution in the event of victimization. Both TRM Labs and FortiGuard independently noted that scam infrastructure is typically seeded weeks to months before major sporting events and promoted aggressively as the event date nears, making pre-tournament vigilance particularly important. Malwarebytes and the FBI both noted that AI tooling has substantially improved the quality of phishing materials, making traditional detection heuristics (poor grammar, suspicious formatting) less reliable.","heading":"Law Enforcement and Industry Guidance","severity":"medium","sources":[{"credibility":1,"name":"FBI IC3 PSA I-052726-PSA: Threat Actors Spoofing FIFA Websites","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"Coincentral: TRM Labs Warns FIFA Fans as Crypto Scams Hit World Cup","type":"news_article","url":"https://coincentral.com/trm-labs-warns-fifa-fans-as-crypto-scams-hit-world-cup/"},{"credibility":2,"name":"Decrypt: World Cup Crypto Scams Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns"}]}],"sources_used":[{"credibility":1,"name":"FBI IC3 PSA I-052726-PSA: Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup","type":"regulatory","url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"credibility":2,"name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"credibility":2,"name":"FortiGuard Labs: Cybercriminals Are Targeting the FIFA World Cup 2026","type":"research","url":"https://www.fortinet.com/blog/threat-research/cybercriminals-are-targeting-the-fifa-world-cup-2026"},{"credibility":2,"name":"Malwarebytes: The 2026 World Cup Scam Economy Is Already Running Before the First Whistle","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"credibility":2,"name":"The Hacker News: FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins","type":"news_article","url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html"},{"credibility":2,"name":"Decrypt: World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns"},{"credibility":2,"name":"Cryptopolitan: FBI Alerts FIFA World Cup Fans Crypto Scams","type":"news_article","url":"https://www.cryptopolitan.com/fbi-alerts-fifa-world-cup-fans-crypto-scams/"},{"credibility":2,"name":"CoinCentral: TRM Labs Warns FIFA Fans as Crypto Scams Hit World Cup","type":"news_article","url":"https://coincentral.com/trm-labs-warns-fifa-fans-as-crypto-scams-hit-world-cup/"},{"credibility":2,"name":"Bitcoin Foundation: FIFA World Cup Crypto Scams Started Before 2026 Tournament, Data Shows","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/fifa-world-cup-crypto-scams-started-before-2026-tournament-data-shows/"},{"credibility":2,"name":"BitcoinWorld: 95% Of World Cup Token WCUP Supply Pre-Purchased By Single Group, Bubblemaps Alleges","type":"news_article","url":"https://bitcoinworld.co.in/world-cup-token-wcup-scam-bubblemaps/"},{"credibility":2,"name":"Help Net Security: Free, No-Signup World Cup Streams Serve Scams Instead of Football","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/23/fake-world-cup-streaming-sites-scams/"},{"credibility":2,"name":"Bitdefender: FBI FIFA Scams 2026 World Cup","type":"research","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-fifa-scams-2026-world-cup"}],"summary":"A coordinated, multi-vector scam infrastructure emerged around the 2026 FIFA World Cup (June 11 – July 19, 2026), targeting fans through fake ticketing domains, insider-heavy memecoins, deepfake impersonation campaigns, fake live-streaming sites, and phishing-as-a-service kits. The FBI, TRM Labs, Malwarebytes, and FortiGuard Labs each issued independent warnings, with FortiGuard identifying over 13,000 FIFA-themed domains registered between January and May 2026, approximately 8.8% of which were classified as malicious or suspicious. Law enforcement flagged 30+ explicitly spoofed FIFA domains by name, while blockchain analytics firms documented a low-liquidity memecoin with alleged 95% insider supply concentration and cross-chain bridge laundering patterns.","timeline":[{"date":"2025-08-01","event":"FortiGuard Labs documents the start of fraudulent FIFA domain registrations, with over 4,300 domains registered from August 2025 onward ahead of the 2026 tournament.","source":"FortiGuard Labs","source_url":"https://www.fortinet.com/blog/threat-research/cybercriminals-are-targeting-the-fifa-world-cup-2026"},{"date":"2026-01-01","event":"Fixed-match betting scam begins receiving Bitcoin payments from victims; TRM Labs later identifies the address as part of its World Cup fraud cluster.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"date":"2026-01-01","event":"FortiGuard Labs documents a surge in FIFA-themed domain registrations between January and May 2026, with over 13,000 new domains registered and 8.8% classified as malicious or suspicious.","source":"FortiGuard Labs","source_url":"https://www.fortinet.com/blog/threat-research/cybercriminals-are-targeting-the-fifa-world-cup-2026"},{"date":"2026-04-01","event":"A Polygon-based fake ticketing address receives approximately $1,562 in a single day, consistent with a short promotional window; TRM Labs later identifies this as part of its World Cup fraud cluster.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"date":"2026-05-04","event":"Malwarebytes publishes threat intelligence report documenting a four-part scam economy already operational before the World Cup, including fake token airdrop sites using FIFA branding.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistle"},{"date":"2026-05-27","event":"FBI Cyber Division issues Public Service Announcement I-052726-PSA through IC3, formally warning fans about over 30 spoofed FIFA domains and typo-squatting campaigns.","source":"FBI IC3","source_url":"https://www.ic3.gov/PSA/2026/PSA260527"},{"date":"2026-06-03","event":"Los Angeles County Sheriff's Department issues advisory warning fans about crypto-only payment demands in fake ticket, hospitality, merchandise, and streaming scams.","source":"Decrypt","source_url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns"},{"date":"2026-06-10","event":"WCUP (World Cup PvP) token launches; Bubblemaps alleges that over 30 newly created wallets with no prior history acquired 95% of supply within the first minute, with the token reaching a $50 million market cap.","source":"BitcoinWorld / Bubblemaps","source_url":"https://bitcoinworld.co.in/world-cup-token-wcup-scam-bubblemaps/"},{"date":"2026-06-11","event":"FIFA World Cup 2026 tournament begins. TRM Labs publishes its full crypto scam tracking report, documenting four active fraud addresses and five scam typologies.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup"},{"date":"2026-06-12","event":"Multiple media outlets, including Bitcoin Foundation, CoinCentral, and Cryptopolitan, publish coverage of the coordinated World Cup crypto scam infrastructure based on TRM Labs and FBI findings.","source":"Bitcoin Foundation","source_url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/fifa-world-cup-crypto-scams-started-before-2026-tournament-data-shows/"},{"date":"2026-06-23","event":"Help Net Security reports Malwarebytes has identified over 40 fake World Cup streaming websites using identical templates that deliver ad fraud and crypto scheme redirects instead of match streams.","source":"Help Net Security","source_url":"https://www.helpnetsecurity.com/2026/06/23/fake-world-cup-streaming-sites-scams/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9d50a682-b878-419c-ae7f-0bee6b1bd3a7copy