Threat Actors Attacking Fans and Teams of Belgian Grand Prix With Phishing Campaigns

Cybercriminals have launched a sophisticated multi-vector attack campaign targeting fans and teams ahead of the 2025 Belgian Grand Prix, scheduled for July 27 at the iconic Spa-Francorchamps circuit.

The threat actors have deployed an arsenal of tactics including phishing emails, fraudulent ticket websites, malicious streaming platforms, and counterfeit merchandise scams to exploit the global enthusiasm surrounding Formula 1’s premier racing event.

The campaign’s foundation was established through a significant security breach that occurred in early 2024, when threat actors successfully compromised the official Belgian Grand Prix email account.

This initial foothold enabled attackers to conduct large-scale phishing operations with enhanced credibility, as fraudulent communications appeared to originate from legitimate race organizers.

The compromised infrastructure has since been leveraged to distribute deceptive emails promising discounted tickets and exclusive access to unsuspecting Formula 1 enthusiasts.

CloudSEK analysts identified a dramatic surge in malicious domain registrations specifically crafted to impersonate official Formula 1 and Spa-Francorchamps websites.

The researchers documented 16 suspicious domains, with 14 registered between 2024 and 2025, indicating a coordinated preparation phase leading up to the race weekend.

These domains serve multiple malicious purposes, including hosting phishing pages designed to harvest personal and payment information, distributing malware disguised as ticket PDFs or streaming applications, and spreading misinformation to generate fraudulent revenue.

Infrastructure Analysis and Domain Spoofing Tactics

The threat actors have demonstrated sophisticated domain spoofing techniques, registering variations that closely mimic legitimate Formula 1 terminology and branding.

Analysis of the malicious infrastructure reveals a strategic approach to domain selection, with registrations accelerating in the months preceding the Belgian Grand Prix.

The attackers have strategically distributed their infrastructure across multiple registrars including NameCheap, Network Solutions, and OVH to evade detection and complicate takedown efforts.

This diversification strategy, combined with the use of legitimate-sounding domain names, creates a formidable challenge for both security teams and potential victims attempting to distinguish authentic platforms from malicious alternatives.

The timing of these registrations, clustered around the race announcement and ticket sales periods, demonstrates careful planning and market awareness by the threat actors.

Integrate ANY.RUN TI Lookup with your SIEM or SOAR To Analyses Advanced Threats -> Try 50 Free Trial Searches