Emerging Playbooks: How Scammers Leverage Vibe Coding for Fraudulent Ticket Sites

After years of anticipation, the 2026 FIFA World Cup has kicked off. The massive amount of attention paid to the event, along with high ticket demand, creates a perfect environment for opportunistic scammers looking to lure fans seeking last-minute deals. The ticket scam game has been seen before. What’s new is the sophistication of the storefronts, made possible by AI vibe coding software.

We recently uncovered scam websites offering World Cup packages. We observed two websites, worldcup2026ticket[.]shop and ticketworldcup2026[.]com, that claimed to be "Authorized FIFA ticketing partners." Months before the final teams were decided, scam actors started registering domains with titles like these or typosquatted variations—a common tactic during big events. What’s new is AI tools like Lovable.dev make it possible for scammers to launch well-designed websites, likely within minutes.

The scam site in this example presents a polished, professional-looking front. We are highly confident the site was built with Lovable, as evidenced by the default Lovable.dev favicon in the address bar. Using AI to build the site not only enables sophisticated design but also instantly populates it with pertinent content, including match schedules and ticket options. This example includes a schedule of all the cities and teams. No ticket pricing information is listed on the site.

The Shift to Encrypted Channels and Cross-Platform Lures

What makes this counterfeit World Cup site notable is the absence of the classic "too good to be true" pricing signal; in fact, no prices are listed. At a costly event like the World Cup, this omission could be intentional to prompt the victim to reach out to the scammer directly. Scam domains are often set up for temporary use, and it is not uncommon for the quality to be lacking or incomplete.

Online scammers often shift conversations from public-facing infrastructure to private, encrypted channels. In this case, the "Contact Us" buttons on the detected sites linked to two different WhatsApp numbers utilizing +1 country codes (U.S. and Canada).

While AI tools dramatically speed up development and lower the skill barrier to building convincing fraud infrastructure, they do not inherently improve the engagement or quality of the auxiliary social media accounts used to promote them.

Based on the underlying infrastructure,including mail servers, hosting providers, and cached registration data pointing to Chinese and Vietnamese user networks, we assess that this activity likely originated with operators in China or Southeast Asia. We have not observed these actors operating within a larger network. With the accessibility and low cost of AI tools for quickly spinning up these operations, it is easier for small operations to produce the online presence needed to lure victims. With the low investment costs, the scheme can be profitable even if only a few people fall for the bait.