Date: 07/06/2026
Severity: High
Summary
Researchers identified a large network of pirated sports streaming websites exploiting the popularity of the FIFA World Cup through mirror domains, cloud-hosted infrastructure, and domain rotation techniques to evade takedowns. The campaign also distributes fake Stremio installers (APK/EXE) and VPN-themed lures, exposing users to malware, scams, and affiliate-driven downloads. Key themes include copyright infringement, phishing, malware distribution, typosquatting, cloud infrastructure abuse, and social engineering targeting sports fans.
Indicators of Compromise (IOC) List
Domain/URLs: | apkforgivesus.biz cloudflare-br-34-ionp.std.epremo-akam.com live-tv.sbs livetv901.me stremio-app.com stremio-dl.com stremio.watch stremioguide.com stremo.tv vipleague.ws worldcup2026live.xyz worldcupstream.me https://7imaya.site/ar https://aimbot.dev/download https://app-rush.com/vpnupdate/ https://buffsports.io/watch-2026-fifa-worldcup https://buffstreamss-tv.s3.amazonaws.com/index.html https://quickstream-app.com/preland/ https://vipleague-sx.storage.googleapis.com/index.html https://vpn-explained.com/propeller/ https://watchfootballhighlights.com/schedules/2026-06-19 https://www.viprow.sx/world-cup/belgium-vs-egypt-online-stream-1 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://app-rush.com/vpnupdate/" or url like "https://app-rush.com/vpnupdate/" or siteurl like "https://app-rush.com/vpnupdate/" or domainname like "https://buffsports.io/watch-2026-fifa-worldcup" or url like "https://buffsports.io/watch-2026-fifa-worldcup" or siteurl like "https://buffsports.io/watch-2026-fifa-worldcup" or domainname like "stremioguide.com" or url like "stremioguide.com" or siteurl like "stremioguide.com" or domainname like "https://www.viprow.sx/world-cup/belgium-vs-egypt-online-stream-1" or url like "https://www.viprow.sx/world-cup/belgium-vs-egypt-online-stream-1" or siteurl like "https://www.viprow.sx/world-cup/belgium-vs-egypt-online-stream-1" or domainname like "https://7imaya.site/ar" or url like "https://7imaya.site/ar" or siteurl like "https://7imaya.site/ar" or domainname like "vipleague.ws" or url like "vipleague.ws" or siteurl like "vipleague.ws" or domainname like "stremo.tv" or url like "stremo.tv" or siteurl like "stremo.tv" or domainname like "live-tv.sbs" or url like "live-tv.sbs" or siteurl like "live-tv.sbs" or domainname like "stremio.watch" or url like "stremio.watch" or siteurl like "stremio.watch" or domainname like "https://buffstreamss-tv.s3.amazonaws.com/index.html" or url like "https://buffstreamss-tv.s3.amazonaws.com/index.html" or siteurl like "https://buffstreamss-tv.s3.amazonaws.com/index.html" or domainname like "https://watchfootballhighlights.com/schedules/2026-06-19" or url like "https://watchfootballhighlights.com/schedules/2026-06-19" or siteurl like "https://watchfootballhighlights.com/schedules/2026-06-19" or domainname like "livetv901.me" or url like "livetv901.me" or siteurl like "livetv901.me" or domainname like "https://vipleague-sx.storage.googleapis.com/index.html" or url like "https://vipleague-sx.storage.googleapis.com/index.html" or siteurl like "https://vipleague-sx.storage.googleapis.com/index.html" or domainname like "stremio-app.com" or url like "stremio-app.com" or siteurl like "stremio-app.com" or domainname like "worldcupstream.me" or url like "worldcupstream.me" or siteurl like "worldcupstream.me" or domainname like "apkforgivesus.biz" or url like "apkforgivesus.biz" or siteurl like "apkforgivesus.biz" or domainname like "https://aimbot.dev/download" or url like "https://aimbot.dev/download" or siteurl like "https://aimbot.dev/download" or domainname like "https://vpn-explained.com/propeller/" or url like "https://vpn-explained.com/propeller/" or siteurl like "https://vpn-explained.com/propeller/" or domainname like "worldcup2026live.xyz" or url like "worldcup2026live.xyz" or siteurl like "worldcup2026live.xyz" or domainname like "stremio-dl.com" or url like "stremio-dl.com" or siteurl like "stremio-dl.com" or domainname like "https://quickstream-app.com/preland/" or url like "https://quickstream-app.com/preland/" or siteurl like "https://quickstream-app.com/preland/" or domainname like "cloudflare-br-34-ionp.std.epremo-akam.com" or url like "cloudflare-br-34-ionp.std.epremo-akam.com" or siteurl like "cloudflare-br-34-ionp.std.epremo-akam.com" |
Reference: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-07-01-sites-taking-advantage-of-FIFA-World-Cup-popularity.txt