Seven Fake FIFA Job Portals Share One Registrar, One Certificate
A cluster of FIFA-recruitment lookalike domains built on identical registrar, IP and DigiCert issuance feeds into a separate VBS downloader wave tied to TA505, terminating in a bulletproof-style Omegatech LTD payload cluster. The consistency across registrar, DNS, and certificate layers marks the delivery infrastructure as purpose-built rather than opportunistic.
Seven lookalike domains built around FIFA hiring and career themes — fifa-careerhub.com, fifa-hr.com, jobs-fifa.com, fifa-careerpath.com, fifa-hiring.com, fifa-careerportal.com, and fifahiring.com — sit behind a single automated registration pipeline. Six of the seven were registered through Name.com, Inc., resolve to the identical A-record 91.195.240.94, share all four name.com nameservers (ns1kpv, ns2kry, ns3jmt, ns4dmx), and were issued near-identical certificates from DigiCert's "Encryption…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read