New Delhi: More than 1,000 fake IPL-related domains are being used to run online scams and malware attacks targeting cricket fans during the ongoing Indian Premier League season, a report showed on Wednesday, May 13.
According to an analysis by CloudSEK, researchers identified more than 600 fraudulent domains selling fake IPL tickets and over 400 fake “free streaming” websites, many of which were being used as malware delivery platforms.
The report stated that cybercriminals are increasingly exploiting the urgency and emotional behaviour of cricket fans, especially those searching for last-minute match tickets or free online streams during high-profile fixtures.
“The fake ticketing backend shows how industrialised these scams have become. Operators are not only selling fake tickets. They are tracking conversions, adjusting prices, verifying payments and collecting victim data that can be reused or sold for future scams,” said Sourajeet Majumder.
“IPL brings together scale, emotion and urgency. That is exactly what cybercriminals exploit,” Majumder added.
The report further found that many fake ticketing websites impersonated trusted platforms by copying familiar logos, layouts and booking flows.
Users were asked to select seats, enter personal details and make payments through UPI, cards, QR codes or payment gateways, the report said.
In several cases, fake PDF tickets carrying booking IDs and QR codes were delivered to users after payment, only for victims to discover the fraud at stadium entry gates.
The report also flagged that scammers were using Meta Pixel integration to track clicks, form submissions and payment activity, enabling them to optimise fraud campaigns similarly to legitimate e-commerce businesses.
Apart from fake ticketing scams, the report highlighted the growing threat from fake IPL streaming websites.
These websites were often optimised for searches such as “IPL free live stream” and match-specific streaming queries.
The report warned that several of these websites acted as gateways for malware infections, suspicious redirects and credential theft attacks.
