I'm not even a big football person, and I still felt the pull when a "last remaining World Cup tickets" page landed in front of me. Sold out everywhere else, right logo, price almost too good. That "almost too good" is the moment to stop. Before your card comes out of your wallet, do one thing: read the web address, character by character. That's where the whole scam lives.
Why is this scam everywhere right now?
The 2026 World Cup is one of the biggest ticket scrambles in years, and scammers know it. On May 27, 2026, the FBI's Internet Crime Complaint Center issued a public warning (Alert Number I-052726-PSA) about cyber threat actors spoofing the FIFA website ahead of the tournament. In plain terms: criminals are standing up fake copies of the official site to sell tickets and hospitality packages that don't exist, and to harvest your personal and banking details in the process.
According to the FBI, these sites are built to collect your name, home address, phone number, email address, and banking information. That's not a side effect. That's the goal. The "ticket" is the bait; your data and your card are the catch. The warning was picked up by consumer outlets including Fox News and AARP, both flagging the same thing: desperate fans chasing scarce tickets are the target.
The trick: it's all in the address
The FBI's alert notes that the spoofed websites "may feature alternate spellings" of the real address. That's the entire move. The real home of FIFA is fifa.com. A scammer can't register that, so they register something that reads like it at a glance but is a completely different address owned by someone else.
One example named in the reporting is wvvw-fifa.com. Look closely: the "w" at the front is actually two "v" characters, vv, pushed together to fake the shape of a "w." At reading speed, your eye fills in "www" and moves on. To every computer on the internet, though, wvvw-fifa.com is a stranger's website, not FIFA's. Sneaky, isn't it? 😅
fifa.comFIFA's actual registered domainwvvw-fifa.comthe "w" is two "v"s; and fifa.com sits after a hyphen, not as the real domainThe FBI's PSA lists a batch of these spoofed domains; reporting on the alert cites 36 specific addresses. They follow a few predictable patterns, and once you've seen the shapes they use, they're much harder to fall for.
| The pattern | Example shape | Why it works on your eye |
|---|---|---|
| Fake "w" from two "v"s | wvvw-fifa.com | Two v's pushed together read as a w at a glance. |
| Brand name buried in the middle | www.fifa-ticket.live | You see "fifa" and stop reading; the real domain is fifa-ticket.live, not FIFA. |
| Unusual ending after the name | www.fifa.cab | The word "fifa" is there, but the ending isn't .com; it's a different, unrelated address. |
www.fifa-ticket.live/buy, the real address is fifa-ticket.live, not fifa anything. The brand name sitting in the middle proves nothing.Where do these fake FIFA sites reach you?
- Search results and ads. A scam site can buy its way to the top of a search for "World Cup tickets." Being the first result is not a safety signal.
- Email and text messages. "Your ticket lottery result is ready" with a link. The link text can say
fifa.comwhile the actual address underneath goes somewhere else entirely. - Social media posts and DMs. A stranger with tickets to unload, pointing you to a checkout page that looks official.
The FBI expects more of these fake domains to appear as the tournament gets closer, so a site that wasn't flagged last week can be a fresh scam this week.
How do you check the address by hand?
- Stop before you type your card. The urgency ("only 3 left!", "sale ends in 8 minutes") is manufactured. It exists to stop you from doing exactly this check.
- Find the real domain. In the address bar, it's the part just before the first single slash. Ignore everything after that slash and anything the site put before the domain.
- Read it right to left. The ending and the word right before it are the real address. If that isn't exactly
fifa.comfor FIFA, or the official reseller FIFA itself points to, treat the page as unproven. - Don't retype the domain. If you're checking a link, copy it rather than typing it out. Retyping quietly "fixes" the swap in your head and hides the trick.
- Or paste the domain into IP Tracker and let it do the comparison in seconds.
How does IP Tracker help with a FIFA lookalike?
IP Tracker is a free Chrome extension. Paste a domain or a full web address into the popup; the free tier gives you 25 checks a day, with no account and no tracking. Only the value you paste is looked up.
For a domain like wvvw-fifa.com, it does the boring version of the manual check, every time. It normalizes look-alike shapes and compares the result against the official domains of 120 widely impersonated brands. It also checks whether Google Safe Browsing (Google's list of reported dangerous sites) has flagged the address, how many security vendors flag it on VirusTotal, community abuse reports, and when the domain was registered. Scam sites for an event like this are often days or weeks old, and a fresh registration date is a useful corroborating clue, shown as a supporting line, never as a verdict on its own.
The result is a plain-English read of what's known about the address, so you can decide with your eyes open instead of guessing under pressure.
What can't it do?
Honesty matters more than comfort here, so a few limits worth knowing:
- It can't confirm a site is the official seller. It flags lookalike patterns and known-bad signals. It doesn't hold FIFA's official ticketing list, so "not flagged" doesn't mean "this is the real FIFA."
- Brand-new scam domains lag the blocklists. Google Safe Browsing is strong on reported sites, but a fake FIFA domain registered yesterday may not be listed yet. The FBI's own warning expects new domains to keep appearing.
- Some patterns slip past automated comparison. A brand name buried in the middle of an otherwise unrelated domain can look "clean" to a character check while still being a scam. Reading the domain right to left yourself catches these.
- It checks the address, not the offer. A real-looking domain can still be a reseller charging far above face value. The domain check is one signal, not the whole decision.
The safest path to a World Cup ticket is still the boring one: start from FIFA's official channels yourself, don't follow a link someone sent you, and if a deal feels urgent and too good, that feeling is the scam working. If you've been targeted, you can report it to the FBI at ic3.gov.
To summarize:
- ✓ The real address is
fifa.com; anything else selling "official" tickets is unproven. - ✓ Find the real domain, the part before the first single slash, and read it right to left.
- ✓ Don't let urgency rush your card out of your wallet.
- ✓ Or paste the address into IP Tracker and let it flag the lookalike for you.
Enjoy the tournament, not the scam! ⚽