#domainabuse — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #domainabuse, aggregated by home.social.
-
2026-2026worldcup[.]com[.]cn
2026-bet-fifacup[.]com
2026-buy-fifa[.]com
2026-entrance-fifacup[.]com
2026-fifabetting-jackpot[.]comThe volume and repetition suggest bulk registration rather than one-off opportunists. We're talking infrastructure built for scale to leverage peak tournament traffic.
Seeing similar scams? Share them with us via the Threat Intel Portal:
👉️ https://submit.spamhaus.orgAnd congrats to the England team on their 3-2 win over Mexico! 🤩
-
Having trouble finding a free 📺 streaming site for World Cup 🏟️ matches? This threat actor has you covered with thousands of websites for all 104 matches! ⚽
We've been tracking a likely Vietnam-based actor that mass purchases expired domains (we call these dropcatch) and repurposes their existing web traffic to funnel visitors into illegal sports streaming sites, and then straight into a betting platform the same actor operates. The domain portfolio is a graveyard of real internet history: 2026worldcupnorthamerica[.]com (once cited by the Dallas Morning News and the US Men's National Team Facebook fan page), childreninachangingclimate[.]org (formerly a children's aid program), thebreastcancercharities[.]org (formerly non-profit The Breast Cancer Charities of America), and a domain officially used by major US grocery store chains involved in a large proposed merger. Collectively, this actor has spent hundreds of thousands of dollars acquiring dropcatch domains alone — a strong signal that dropcatching is a genuinely effective vehicle for cyber fraud. Behind all of it sits a staggering tech stack operated by a single actor: 5,000+ domains, illegal streaming services, CDNs, TDSs, trackers, cloakers, betting platforms, and mobile apps. That's not a side hustle, that's an enterprise. 🏗️
While the platform largely targets Vietnamese-speaking users, as well as others in Asia and Oceania, the financial damage reaches much further. Sports authorities and broadcasters worldwide are 📉 losing revenue every time someone watches a live NBA 🏀 , MLB ⚾ :, esports 🎮 , poker 🃏 , or World Cup 🏆 match for free on one of these sites, and this actor has all of them covered.
Some examples from the domains we've uncovered so far:
:Dropcatch domains host or redirect to illegal streaming services
autoredistrict[.]org
childreninachangingclimate[.]org
2026worldcupnorthamerica[.]com
folsomprisonmuseum[.]org
allaboutbasketball[.]us
thebreastcancercharities[.]org:Fraudulent domains host or redirect to illegal streaming services
90phutaa[.]cc
90phutab[.]cc
90phutac[.]cc
xoilaczzzzw[.]tv
xoilaczzzzt[.]tv
xoilaczzzzh[.]tv:Lookalike domains used by the betting platforms
fifa001[.]com
fifa002[.]com
fifa02[.]com
worldcup00[.]com
worldcup000[.]com
worldcup02[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #dropcatch #malvertising #illegalstreaming #sportsbetting #domainabuse #vietnam #worldcup #asia #fifa #streaming #betting #2026worldcup #charities #nonprofit #lookalike #xoilac #90phut
-
Malicious Actors Accounted for as much as 20% of New Domain Name Registrations in 2025
A new analysis by Interisle Consulting Group finds that cybercriminals registered a significant share of new domain name registrations in 2025, representing a substantial percentage of the generic Top-Level Domain (gTLD) market.
The study establishes that malicious actors purchased at least 10 percent of all newly registered gTLD domains in 2025, with projections indicating that the actual share may be closer to 20 percent.
#domainname #domainabuse #cybercrime #maliciousdomains #dnsabuse
https://interisle.substack.com/p/malicious-actors-accounted-for-as
-
🌐 OUT NOW | Spamhaus Domain Report Oct 2025 - March 2026!
⬆️ 46.9 million new domains
⬇️ 2.15 million malicious domain detections
⬆️ Domains associated with botnet C&C’s (+289%) & malware (+206%)
🔄 .bond (and many more!) see high churn of new registrationsAnd find out which TLD has a massive 17.5% of its zone file listed 😱!
Read the full domain report here 👉 https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-oct-2025-mar-2026/
-
🌐 NEW DOMAIN TRENDING TERMS | 6 new entries linked to user behaviour and search activity: system (#2), engine (#4), search (#6), internet (#9), information (#10), keyword (#11).
🤖 With algorithms shifting towards Large Language Models (LLMs), are we seeing an increase in black hat SEO activity? 🎩
Learn more in the latest #DomainReputation Update 👇👇
https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-april-september-2025/ -
⚠️ Nevertheless, if you see a .mobi link in a text message or email — especially one asking you to login or make payment — think twice before you click it.
-
Interisle Consulting Group has annually published landscape studies on the scope and distribution of phishing. We’ve used the same data sources so that our analyses would be longitudinally consistent. Today, we begin a new series by looking at phishing attacks and how phishers acquired name resources since May 2020.
#phishing #cyberrime #fraud #domainabuse #dnsabuse #cyberattack
https://open.substack.com/pub/interisle/p/phishing-in-the-2020s-intro
-
.top remains firmly in the #2 spot for gTLDs most associated with phishing based on the number of detections we’re seeing 📈.
Missed our latest blog post on what’s going on with .🔝? And more importantly, what can be done to stop the ongoing proliferation in phishing abuse? ✋
Read the Domain Reputation Spotlight here ⤵️
https://www.spamhaus.org/resource-hub/service-providers/abuse-takes-its-toll-on-top/ -
From hidden threats to frontline resilience and domain abuse – today’s sessions are packed with insight!
🎤 Leslie Daigle – Attack traffic is everywhere. Learn how to trace & tackle it. #CyberSecurity
🇺🇦 Pavel Koroteev – How a Ukrainian #IXP stayed strong during war.
🌐 Sam Cheadle – 25% of new #gTLDs show abuse patterns. Here’s how to spot them.👉 Watch live or catch up: https://ripe90.ripe.net
-
We've talked before about abuse issues with .top domains, and sadly, things aren’t getting better. In fact, we’re now seeing a rise in "toll scams" you might have spotted hitting the headlines in recent weeks. 📈🗞️
But, why is this happening? What do we actually know about .🔝? And more importantly, what can be done to stop it? ✋
Learn more in the latest Domain Reputation Spotlight 🔦 ⤵️
https://www.spamhaus.org/resource-hub/service-providers/abuse-takes-its-toll-on-top/#DotTop #DomainAbuse #TollScam #Registrars #CyberSecurity #ThreatIntel
-
🌐 Spamhaus Reputation Statistics - ccTLDs:
https://www.spamhaus.org/reputation-statistics/cctlds/domains/ -
"com-track" has entered the Top20 as the #1 phishing term 🎣 , with a massive 17,061 detections! Cybercriminals are increasingly using the technique of hyphenated domains to exploit the credibility of TLDs like “.com” and deceive users.
Learn more about this growing trend in the #DomainReputation Update👇
https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-oct-2024-mar-2025/ -
When it comes to domain abuse, phishing, and cybercrime, Spamhaus' Top Contributor🏅"Equalizer" doesn't just track threats - they neutralize them. They work tirelessly to:
✅ Shut down phishing networks
✅ Shut down ASNs
✅ Identify & report domain abuse at “large scale”
✅ Collaborate with law enforcement agenciesOver the last 30 days "Equalizer" has submitted 20,431 domains to Spamhaus. That's an increase of +2,595%! And we sincerely thank you for your efforts. 🙏
If you're in the cybersecurity trenches, join the Spamhaus Threat Intel Community as a contributor. Share insights, report cybercrimes and play your part to "equalize" (sorry, we couldn't resist) the battlefield.
You can learn more on how to submit malicious or suspicious raw source, IPs, domains, and URLs here 👉 https://submit.spamhaus.org
The more we collaborate as a community, the stronger we are. 💪 🌍
#CyberSecurity #ThreatIntelligence #Spamhaus #Phishing #DomainAbuse #ThreatHunting #Infosec #FightingCybercrime
-
And this discussion is going on for years:
-
I will be participating in a CircleID+Edgemoor Research:
Beyond WHOIS: Towards a New Framework of Internet Domain Registration Data DisclosureDuring the event, we will discuss a domain registration data framework for balancing privacy with legitimate data needs, emphasizing policy clarity, efficiency, and adaptability.
Date: Thursday, Feb 6, 2025
Time: 2:00 pm - 3:30 pm EST
Place: Online via Zoom
https://us06web.zoom.us/j/84326468738?pwd=QtyYkZhihRbcsMltRjLJ82EmMavgmt.1 -
Hackers Attacking Global Sporting Championships Via Fake Domains To Steal Logins https://gbhackers.com/hackers-sporting-events-phishing/ #CyberSecurityNews #PhishingAttacks #cybersecurity #DomainAbuse #Phishing
-
Brian Krebs recent article - Why Phishers Love New TLDs Like .shop, .top and .xyz - begins with a review of Interisle's Cybercrime Suppy Chain 2024 study findings and measurements and dives into an investigative area where he excels: identifying the parties behind the crimes.
Brian reports that "At least some of that increase is likely from a prolific cybercriminal using the nickname Chenlun, who has been selling phishing kits targeting domestic postal services in the United States and at least a dozen other countries."
While the title suggests this post is about TLDs, Brian also calls attention to our findings regarding subdomain providers, noting that "cyberattacks hosted at subdomain provider services can be tough to mitigate, because only the subdomain provider can disable malicious accounts or take down malicious web pages."
Brian caught up to CAUCE president and Interisle's friend and colleague John Levine, who was brutally frank about ICANN’s proposed next round envisions accepting applications for new gTLDs in 2026. #worthreading #krebsonsecurity #cybercrime #domainabuse
Krebs article: @krebsonsecurity
https://krebsonsecurity.com/2024/12/why-phishers-love-new-tlds-like-shop-top-and-xyz/
Cybercrime Supply Chain 2024:
-
Spotlight: Impersonation phishing using exact match hostnames
Phishers have long embedded exact matches of brands in domain names that they register for phishing. Company, service, or product names in domains continue to deceive less technically savvy members of society. Phishers are increasingly using exact match strings to compose hostnames at free web sites for phishing.
For the period, impersonation attacks against two brands stood out: United States Postal Service (USPS) and Facebook. Looking closely at these two brands, we are able to illustrate how phishers employ these different naming methods.
https://www.cybercrimeinfocenter.org/phishing-trends-november-january-2024
#phishing #brandimpersonation
#domainnames
#domainabuse #dnsabuse -
My interview with the #spamhausproject
Trends, policy and cheap TLDs - an interview with Dave Piscitello
https://www.spamhaus.org/resource-hub/cybercrime/trends-policy-and-cheap-tlds-an-interview-with-dave-piscitello/I've had the pleasure of working with the Spamhaus Team for nearly 2 decades. We collect their reputation data in our #cybercrimeinformationcenter along with a dozen other feeds.
We had a lively discussion about the findings from our October 2023 Cybercrime Supply Chain study. My interview augments our study findings. Hope you enjoy it.
-
Looking at the February-April 2023 phishing activity, one trend stands out. The story...
In March, @briankrebs reported that Meta had filed a lawsuit against Freenom, see https://krebsonsecurity.com/2023/03/sued-by-meta-freenom-halts-domain-registrations/
We’ve observed a significant decline in phishing domains reported in the Freenom commercialized ccTLDs in months surrounding the lawsuit.
Responsible for over 60% of phishing domains reported in November 2022, Freenom’s percentage has dropped to under 15%.
Do you wonder how many targeted organizations could collect a strong case of cybersquatting and infringement against their brands, and why more aren't taking similar actions against TLD operators and registrars?
#cybercrime #domainabuse #cybersquatting #infringement #krebsonsecurity
-
Phishing Trends: November 2022 - January 2023 at #cybercrimeinfocenter
FTA:
72% of domains reported for phishing were malicious domain name registrations (registered by phishers for phishing)
As a follow on to @briankrebs article on the Meta lawsuit filed against Freenom, we share the most recent activity at Freenom before Meta lawsuit.
The phishiest neighborhoods on the Internet? We associated 75,518 IPv4 addresses in six neighborhoods (address prefixes). This represents 18% of all the addresses identified for phishing activity.
https://www.cybercrimeinfocenter.org/phishing-trends-november-january-2023
