Olympics themed domains: what practitioners need to watch now

TL;DR: 1,623 suspicious Olympics themed domains were registered across six months, with activity peaking around the Winter Games and extending into future event cycles, creating a sustained window for brand abuse, counterfeit ticketing, accommodation scams, phishing and malware delivery, according to Bfore's PreCrime Labs analysis.

Editorial analysis by NHI Mgmt Group, based on content published by Bfore: “Cyber Threat Trends During the Winter Olympics 2026”.

By the numbers:

• Across 1,623 suspicious domains, the majority used event-relevant keywords such as “olympic”, “olympics”, “la28” and “milanocortina”.
• The Winter Olympics threat infrastructure was represented by 79 domains, compared with 14 domains focused on the Summer Games.

Key questions

Q: How should organisations detect event-themed domain abuse before users engage with it?

A: Use continuous monitoring for newly registered domains that combine event names with high-risk terms such as tickets, rentals, login, support or AI.

Q: Why do event domains create such effective phishing and fraud opportunities?

A: They borrow a trusted context that users already expect to be real, then add urgency, scarcity and official-looking wording.

Q: What are the warning signs that an event site is part of a scam funnel?

A: Watch for domains that are newly registered, keyword stuffed, routed through disposable hosting, loaded with unrelated scripts or built around forced redirects and pop-ups.

Practitioner guidance

• Monitor event keyword combinations continuously Track registrations that combine Olympic terms with tickets, rentals, travel, parking, support, AI or GPT, and alert on newly created domains that match the pattern.
• Review login and verification pages for brand abuse Inspect pages that request email, verification codes or payments while using event branding, because those are the highest-value credential and fraud capture points.
• Correlate domains with redirect and script behaviour Flag domains that load external JavaScript from unrelated hosts, use hash-like paths or route users through pop-ups, because those are common scam funnel markers.

Bottom line: Event-themed domain abuse works because attackers borrow the trust, urgency and search volume surrounding major competitions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →