Attacks on Sports-Betting Platforms During the 2026 FIFA World Cup
On June 25, 2026, DataDome, a Paris-based cybersecurity company specializing in AI-driven bot protection and fraud prevention for websites, apps, and APIs created a report highlighting bot attacks targeting the sports-betting platforms worldwide during the 2026 FIFA World Cup.
The report, titled Attacks on Sports-Betting Platforms Ramp Up Amid 2026 FIFA World Cup, highlights that in early June, one major European platform blocked an average of around 200,000 requests per day, climbing steadily throughout the month to total nearly 19 million malicious requests blocked in just three weeks. In addition, on the eve of the World Cup’s opening match on June 10th, the same platform was hit by a flash DDoS attack that generated 786,000 requests in 87 seconds, peaking at nearly 18,000 requests per second.
Eventually, it was discovered that the attack originated from Biterika Group LLC, a Russia-based hosting provider previously linked to a DDoS attack against media organizations. DataDome’s telemetry was able to determine that 91% of traffic from Biterika Group is malicious.
DataDome was able to create multiple visuals. The first highlights blocked platform requests, climbing slowly at first, then sharply from June 5 onward as the World Cup approached.
Source: DataDome
Another visual created highlights known proxy infrastructure, data centers, and ISP proxies that carry a prior negative reputation across threat intelligence networks.
Source: DataDome
It should be noted that none of the geolocations reflect the platform’s legitimate user base. Per the report: “A European-regulated betting platform does not receive its traffic from Russia, Indonesia, or South Korea. Every country in this table is proxy-routed or datacenter-hosted infrastructure with geolocations entirely unrelated to the operator’s actual location.”
Lastly, the attacker profile is highlighted in the chart below. As the threat actor replied on IP breadth and burst speed to overwhelm response systems before they could react, the approach was determined to be weak against behavioral detection operating at the fleet level.
Source: DataDome
Detection of Attacks
For flash DDoS, DataDome’s detection operated simultaneously across four layers. IP reputation intelligence was able to flag proxy infrastructure on contact and known-bad IPs were identified and blocked before any behavioral analysis was needed. In addition, TLS fingerprinting and header analysis identified spoofed browser presentations that survived application-layer crafting.
Conclusion
“The surge and uptick in attacks coinciding with the 2026 FIFA World Cup is not coincidental. High-traffic events concentrate value and pressure on platforms simultaneously: odds change fast, users are active, and any disruption has immediate financial and reputational impact.” DataDome concluded by calling on sports-betting platforms to treat major tournament schedules as threat calendars and adjust their posture accordingly.
Related Small Wars Journal Pieces
The Small Wars Journal features a variety of pieces that cover the cyber and network threats that Russia poses.
Marius Kristiansen and Njaal Hoem’s essay, Russian Cyber Strategy, argues that Russia has developed cyber warfare into an integrated component of its grand strategy, while Western states, particularly NATO, have often focused too heavily on technological superiority without sufficiently connecting cyber capabilities to strategic and political objectives.
Nysret Buzhala’s Assessing Russian Network Warfare Through the Lens of the Ukraine Conflict covers Russia’s integrated network-centric warfare model combining cyber operations, AI-enabled information operations, electronic warfare (EW), and space capabilities.
Lastly, Larry Goodson and Marzena Zakowska’s How Russia’s Hybrid Warfare is Changing argues that Russia’s approach to hybrid warfare has undergone a shift, moving away from primarily relying on nonconventional measures and tactics towards a greater emphasis on conventional methods.
