Having trouble finding a free streaming site for World Cup ️ matches? This threat actor has you covered with thousands of websites for all 104 matches! We've been tracking a likely Vietnam-based actor that mass purchases expired domains (we call these dropcatch) and repurposes their existing web traffic to funnel visitors into illegal sports streaming sites, and then straight into a betting platform the same actor operates. The domain portfolio is a graveyard of real internet history: 2026worldcupnorthamerica[.]com (once cited by the Dallas Morning News and the US Men's National Team Facebook fan page), childreninachangingclimate[.]org (formerly a children's aid program), thebreastcancercharities[.]org (formerly non-profit The Breast Cancer Charities of America), and a domain officially used by major US grocery store chains involved in a large proposed merger. Collectively, this actor has spent hundreds of thousands of dollars acquiring dropcatch domains alone — a strong signal that dropcatching is a genuinely effective vehicle for cyber fraud. Behind all of it sits a staggering tech stack operated by a single actor: 5,000+ domains, illegal streaming services, CDNs, TDSs, trackers, cloakers, betting platforms, and mobile apps. That's not a side hustle, that's an enterprise. ️ While the platform largely targets Vietnamese-speaking users, as well as others in Asia and Oceania, the financial damage reaches much further. Sports authorities and broadcasters worldwide are losing revenue every time someone watches a live NBA , MLB :, esports , poker , or World Cup match for free on one of these sites, and this actor has all of them covered.Some examples from the domains we've uncovered so far::Dropcatch domains host or redirect to illegal streaming servicesautoredistrict[.]orgchildreninachangingclimate[.]org2026worldcupnorthamerica[.]comfolsomprisonmuseum[.]orgallaboutbasketball[.]usthebreastcancercharities[.]org:Fraudulent domains host or redirect to illegal streaming services90phutaa[.]cc90phutab[.]cc90phutac[.]ccxoilaczzzzw[.]tvxoilaczzzzt[.]tvxoilaczzzzh[.]tv:Lookalike domains used by the betting platformsfifa001[.]comfifa002[.]comfifa02[.]comworldcup00[.]comworldcup000[.]comworldcup02[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #dropcatch #malvertising #illegalstreaming #sportsbetting #domainabuse #vietnam #worldcup #asia #fifa #streaming #betting #2026worldcup #charities #nonprofit #lookalike #xoilac #90phut
1
2
1
1
