World Cup Streaming Lures Tie Four Registrars to One Operator
Five newly registered domains posing as live 2026 FIFA World Cup stream pages share certificate-issuance and registrar-account fingerprints despite being spread across four registrars and two hosting providers. No payload, hash, or file was captured, leaving a Lazarus Group and 'torpig' attribution resting entirely on infrastructure pattern-matching.
Four landing pages captured in a single infrastructure snapshot all promise the same thing: a live stream of a 2026 FIFA World Cup match. The URLs — watchme.mom/9813/0/fifa/4, sportxlive.sbs/2562/0/soccer%20ss/19, nowstreams.top/player.php/iran-vs-new-zealand-fifa-world-cup-football, and foxtrend.click/event/wc-2026-iran-vs-new-zealand-m — sit on four domains registered through four different registrars, at four different points between February and May 2026.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read