Subdomain-Squatting Fake News: The topnewsource[.]com Clickbait Network

Since late 2024, one operator has run a fake-news content farm that squats real news brands as subdomains of a single attacker-owned apex. Traffic comes from cheap Facebook fan-page ads, and the payout is programmatic display-ad arbitrage rather than credential or payment theft, which is exactly what makes it durable. The apex, topnewsource[.]com, hosts a WordPress multisite where each squatted brand (nbcnews[.]topnewsource[.]com, cnn[.]topnewsource[.]com, bild[.]topnewsource[.]com) is a separate subdomain serving fabricated sports and celebrity "breaking news." It is the live successor to an earlier apex, besttopixs[.]com, and the two share an operator: seed advertiser profiles migrated their click destinations from one apex to the other while we watched.

Key Takeaways

• One attacker apex hosts a WordPress multisite of 47 subdomains; 14 of them squat real news brands across six countries by putting the brand name to the left of the dot, not in the registrable domain.
• Traffic comes from dozens of disposable Facebook advertiser profiles built as sports-team and celebrity/band fan pages, so Meta's interest targeting delivers the ads cheaply to engaged audiences.
• The operator rotates apexes to shed reputation history: besttopixs[.]com to topnewsource[.]com, with two aged-stash rotation domains (fiatagri[.]co, medianews48[.]com) running in parallel as burn hosts.
• Operator continuity is not inferred, it is observed: the same advertiser personas ran click destinations on both apexes, and both apexes carry the identical nbcnews/abcnews/gnews subdomain grammar.
• The landers carry no login form and no checkout. The harm is deception and ad-fraud exposure, so the usual credential-phishing signals do not apply and defenders have to key on infrastructure and content instead.

Background

Content farms built for advertising are a well-documented business, not a novelty. The industry term is "made for advertising" (MFA), and the model is arbitrage: buy the cheapest attention you can find, route it to pages engineered for heavy programmatic ad density, and keep the spread between acquisition cost and ad yield. The ANA's 2023 study put MFA at roughly a fifth of measured impressions and about 15 percent of ad spend among its members, and later measurement showed that spend rising rather than falling. Fabricated "breaking news" is ideal fuel for this loop. It is cheap to mass-produce, it provokes clicks, and it gives brand-safety systems little to grab onto.

The twist in this network is how it borrows credibility. Instead of typosquatting a news outlet's registrable domain (nbc-news[.]com), the operator owns one apex and places the real brand in the subdomain label: nbcnews[.]topnewsource[.]com. A reader scanning left to right sees the brand first and stops before reaching the part of the hostname that actually establishes ownership, the registrable domain topnewsource[.]com. Public squatting taxonomies file this under level squatting or subdomain-based brand impersonation, and the failure mode is the same one that makes it effective: people do not parse a hostname to its registrable boundary.

Traffic acquisition rides Facebook. The operator runs disposable advertiser profiles dressed as fan pages for a sports team, an athlete, or a band, because that persona lets Meta's relevance and interest targeting place the ad in front of a highly engaged audience at low cost. When a page or ad account gets flagged, a new one takes its place faster than enforcement lands. This pattern is not unique to one operator: Alethea's 2025-2026 "NFL Fan Free Zone" work documented coordinated inauthentic sports fan-page networks using generative AI to mass-produce fake quotes and announcements, posting dozens of times a day and funneling readers to ad-stuffed junk sites. Front Office Sports and others have covered the same fabricated-quote and fake-transfer economy across the major leagues.

Discovery and Infrastructure

The network surfaced from a prior investigation into besttopixs[.]com, when two of that apex's highest-volume advertiser profiles were seen redirecting their Facebook ad clicks to nbcnews[.]topnewsource[.]com. Following those profiles forward mapped the successor apex and its full subdomain roster.

The apex is a WordPress multisite. Every squatted brand and every generic content silo is its own subdomain off topnewsource[.]com, 47 distinct subhosts in total, which fall into three grammar buckets.

Subhost bucket	Count	Example labels
News-brand squats	14	nbcnews / abcnews / cnn / foxnews / gnews / nytimes / usatoday / bild / lemonde / lefigaro / cnews / folha / kompas / abante
Active content frontends	3	yourdailystory / enews / dnews
Generic backend labels	30	sport / viral / live / news / 24hnews / nfllove / nbalove / recap

The brand squats span the United States (nbcnews, abcnews, cnn, foxnews, gnews, nytimes, usatoday), Germany (bild), France (lemonde, lefigaro, cnews), Brazil (folha), Indonesia (kompas), and the Philippines (abante), which points at multilingual, multi-region targeting rather than a single-market operation. The generic labels are news and virality nouns with occasional numeric suffixes, the kind of throwaway naming a content farm generates in bulk.

Two rotation domains sit outside the multisite and behave differently. fiatagri[.]co and medianews48[.]com are flat apexes with no subdomains; each serves its articles at apex-level kebab-case paths (fiatagri[.]co/manchester-city-officially-sack-pep-g...). Both carry brand-suggestive names that resolve to nothing: the real Fiat Agri line (now part of CNH Industrial's New Holland) uses fiatagritractors[.]com, and MediaNews Group publishes at medianewsgroup[.]com. Neither branded name has any connection to these registrations.

How It Works

A representative chain runs from a fan-page ad to a fabricated article to an ad-dense page view. A disposable Facebook profile themed for the Detroit Lions or Manchester City or a music act runs a sponsored ad whose creative is an outrage-or-curiosity headline. The click resolves to a brand-labeled subdomain of the apex (or to a rotation domain), where a fabricated story sits inside a heavy programmatic ad stack. There is no account step, no form, no payment. The reader is the product, and the page view is the payout.

The click destination shape is a durable per-cluster tell, because the operator did not unify it across the multisite:

nbcnews.topnewsource[.]com/posts/<kebab-headline>          (news-brand squat lander)
enews.topnewsource[.]com/?p=<int>                          (WordPress default permalink)
cnews.topnewsource[.]com/?p=<int>                          (WordPress default permalink)
dnews.topnewsource[.]com/news/<int>/                       (numeric news path)
fiatagri[.]co/<kebab-headline>                             (rotation domain, apex-level path)
medianews48[.]com/<kebab-headline>                         (rotation domain, apex-level path)

One advertiser stood apart from the disposable pattern. A genuine personal account interleaved real personal posts with injected clickbait links pointing to yourdailystory[.]topnewsource[.]com and enews[.]topnewsource[.]com, which reads as a compromised account briefly repurposed to place ads rather than a purpose-built persona.

Sample Lures

All samples are real advertiser copy observed in Facebook sponsored ads, defanged, with any personal identifier replaced by a placeholder. The subjects of the fabricated headlines are public figures the operator impersonates or invents quotes for; they are not victims whose data was exposed.

Detroit Lions / NFL fan persona, routing to the NBC News subdomain squat:

Persona: fan page "Honolulu Blue"
Ad copy: "A HEARTBREAKING LOSS FOR THE NFL - THE ENTIRE FOOTBALL COMMUNITY IS IN MOURNING..."
Click:   hxxps://nbcnews.topnewsource[.]com/posts/nfl-mourns-the-pas...

Manchester City / EPL fan persona, routing to a rotation domain:

Persona: fan page "Manchester City Global Fans"
Ad copy: "BREAKING: MANCHESTER CITY SACK PEP GUARDIOLA AFTER PREMIER LEAGUE..."
Click:   hxxps://fiatagri[.]co/manchester-city-officially-sack-pep-g...

Celebrity / music fan persona, routing to a WordPress content frontend:

Persona: fan page "Queen of Angelic Voices"
Ad copy: "ONE NOTE. 7 YEARS OF SILENCE. 1 QUEEN RETURNS." (fabricated celebrity comeback)
Click:   hxxps://enews.topnewsource[.]com/?p=<int>

Compromised personal account, injected clickbait alongside genuine posts:

Persona: real individual's account, display name [name]
Ad copy: fabricated music-estate "vault discovery" story
Click:   hxxps://yourdailystory.topnewsource[.]com/?p=<int>

Technical Analysis

Registration Cohorts

WHOIS separates the infrastructure into two clean cohorts, which is itself the story of how the operator provisions.

Apex	Registrar	Created	Cohort
topnewsource[.]com	Namecheap	2024-07-03	Purpose-built 2024 (successor)
besttopixs[.]com	Cosmotown	2024-08-26	Purpose-built 2024 (predecessor)
fiatagri[.]co	Namecheap	2021-07-06	Aged-stash 2021 (rotation)
medianews48[.]com	Namecheap	2021-07-24	Aged-stash 2021 (rotation)

The two apexes were registered about seven weeks apart in mid-2024, with the successor apex behind Namecheap privacy ("Withheld for Privacy ehf"), which is the purpose-built cohort. The two rotation domains are aged 2021 registrations with brand-suggestive names, held and then repurposed as burn hosts for apex-level article paths. Aging a domain before use, then rotating it in as a disposable, is a reputation-laundering move: an older registration carries less immediate suspicion than a week-old one.

Subdomain Build-Out Timeline

The apex did not appear fully formed. Its subhost roster grew from an apex plus a handful of sports labels at founding to 47 subhosts by early 2026, and the international news-brand squats are the most recent additions.

Cohort	Representative new subhosts
Oct-Nov 2024 (founding)	sports / sport / live / viral / en / nytimes / usatoday
May-Jun 2025 (sports silo)	dnews / 360news / recap / nfllove / nbalove / news
Jul-Nov 2025 (build-out)	bild / lemonde / cnews / enews / generic virality labels
Jan-Mar 2026 (intl squat surge)	lefigaro / folha / kompas / abante / yourdailystory

The escalation into non-English news brands (Le Figaro, Folha de S.Paulo, Kompas, Abante) in the first quarter of 2026 is the clearest recent change, and it lines up with the fan-persona ad copy appearing in multiple languages.

Operator Continuity

The link between the two apexes is behavioral and structural, not a guess. Three signals converge:

• A seed advertiser persona ran its click destination on topdaily[.]besttopixs[.]com, then migrated to nbcnews[.]topnewsource[.]com, then to medianews48[.]com, one persona rotating across all three clusters over a few weeks.
• A second seed persona ran click destinations on both nbcnews[.]topnewsource[.]com and medianews48[.]com in the same window; a soccer persona moved from plant[.]besttopixs[.]com to fiatagri[.]co.
• The predecessor apex carries the identical squat grammar, including nbcnews[.]besttopixs[.]com, abcnews[.]besttopixs[.]com, and gnews[.]besttopixs[.]com, the same brand labels later reused on the successor.

Put together, this is one operator swapping the apex underneath a stable playbook rather than two unrelated content farms that happen to look alike.

Persona-to-Destination Mapping

Advertiser personas map onto click-destination families by vertical, which lets a defender pivot from a single ad to a cluster.

Persona / pretext	Primary click-destination family
NFL / Detroit Lions	nbcnews[.]topnewsource[.]com/posts/ and medianews48[.]com
EPL / soccer	fiatagri[.]co and (earlier) plant[.]besttopixs[.]com/posts/
Celebrity / music	enews[.]topnewsource[.]com/?p= and cnews[.]topnewsource[.]com/?p=
Compromised real account	yourdailystory[.]topnewsource[.]com/?p=

Detection Observations

The behavioral signals that separate this traffic from legitimate news distribution are infrastructure-shaped, not content-scored.

• The registrable domain never matches the brand in the hostname. A hostname whose left-most label is a major news brand but whose registrable domain is an unrelated coined word is the single strongest structural tell here. Parsing to the registrable boundary before trusting the brand collapses the whole technique.
• One apex fans out into dozens of brand-labeled subdomains. A single registrable domain hosting nbcnews, cnn, bild, and lemonde subdomains at once is not how any real publisher operates, and the multisite footprint is visible from DNS and certificate transparency without touching content.
• Click-destination path shape clusters the network. The coexistence of /posts/<slug>, WordPress /?p=<int>, and /news/<int>/ under one apex, plus apex-level kebab paths on the rotation domains, groups the properties and ties the rotation domains back to the multisite.
• Fan-page personas do not match the content they push. Sports-team and band fan pages advertising fabricated cross-vertical "breaking news" is a persona-to-content mismatch that holds even when individual headlines look plausible.
• Apex rotation is the persistence mechanism. When advertiser personas that previously pointed at one apex begin pointing at a freshly registered one carrying the same subdomain grammar, that is the operator shedding reputation history, and the migration itself is a detectable event.

Indicators of Compromise

All indicators are defanged. The set below is a representative, verified subset of the operator's infrastructure.

Domains

Value	Role	Notes
topnewsource[.]com	Operator apex	WordPress multisite; Namecheap, created 2024-07-03; successor apex
besttopixs[.]com	Predecessor apex	Same squat grammar; Cosmotown, created 2024-08-26
fiatagri[.]co	Rotation domain	Aged-stash 2021; apex-level kebab paths; no Fiat Agri affiliation
medianews48[.]com	Rotation domain	Aged-stash 2021; apex-level kebab paths; no MediaNews Group affiliation

Hosts (News-Brand Squats)

Value	Impersonated brand
nbcnews[.]topnewsource[.]com	NBC News (US)
abcnews[.]topnewsource[.]com	ABC News (US)
cnn[.]topnewsource[.]com	CNN (US)
foxnews[.]topnewsource[.]com	Fox News (US)
gnews[.]topnewsource[.]com	Google News (US)
nytimes[.]topnewsource[.]com	The New York Times (US)
usatoday[.]topnewsource[.]com	USA Today (US)
bild[.]topnewsource[.]com	Bild (DE)
lemonde[.]topnewsource[.]com	Le Monde (FR)
lefigaro[.]topnewsource[.]com	Le Figaro (FR)
cnews[.]topnewsource[.]com	CNews (FR)
folha[.]topnewsource[.]com	Folha de S.Paulo (BR)
kompas[.]topnewsource[.]com	Kompas (ID)
abante[.]topnewsource[.]com	Abante (PH)

Hosts (Active Content Frontends)

Value	Notes
yourdailystory[.]topnewsource[.]com	Highest-volume frontend; WordPress /?p=
enews[.]topnewsource[.]com	WordPress /?p=
dnews[.]topnewsource[.]com	/news/<int>/ path

URLs (Representative Path Templates)

Value	Role
hxxps://nbcnews[.]topnewsource[.]com/posts/<kebab-headline>	Brand-squat lander
hxxps://yourdailystory[.]topnewsource[.]com/?p=<int>	WordPress frontend lander
hxxps://dnews[.]topnewsource[.]com/news/<int>/	Numeric news-path lander
hxxps://fiatagri[.]co/<kebab-headline>	Rotation-domain lander
hxxps://medianews48[.]com/<kebab-headline>	Rotation-domain lander

Facebook Advertiser Profiles

Value	Notes
facebook[.]com/profile.php?id=61583970457653	Seed persona; besttopixs-to-topnewsource migrant
facebook[.]com/profile.php?id=61588586765921	Seed persona; live rotation across all three clusters
facebook[.]com/profile.php?id=61582914081279	Soccer persona; routes to fiatagri[.]co
facebook[.]com/profile.php?id=61587634547893	Disposable numeric-ID persona
facebook[.]com/beefykins	Compromised real account repurposed for placement
facebook[.]com/JamesBondLegends	Celebrity/character fan persona
facebook[.]com/TopGunBiggestFans	Film fan persona
facebook[.]com/PrinceUltimateFanCommunity	Music fan persona
facebook[.]com/Queen.TheGreatestRockBandEver	Music fan persona
facebook[.]com/MJKingofPop.555	Music fan persona
facebook[.]com/ImagineDragons.Believer.My.Inspiration	Music fan persona
facebook[.]com/ghjkgh2342	Throwaway alphanumeric persona

(Representative subset; 50+ verified-malicious Facebook advertiser profiles across the network.)

MITRE Fight Fraud Framework (F3) Mapping

The MITRE Center for Threat-Informed Defense published its fraud matrix in 2026 as the Fight Fraud Framework (F3), using TA/FA identifiers for tactics and T/F identifiers for techniques. F3 is scoped to financial fraud, so this campaign maps cleanly on its front half (account and infrastructure creation, traffic acquisition, brand impersonation) and hits a genuine gap on the back end, since ad-arbitrage revenue has no dedicated monetization technique in the framework.

Tactic	Technique	ID
Resource Development	Establish Accounts (disposable advertiser / fan-page personas)	T1585
Resource Development	Acquire Infrastructure: Domains (attacker apex for subdomain squatting)	T1583.001
Resource Development	Acquire Infrastructure: Malvertising (paid social ads as traffic acquisition)	T1583.008
Resource Development	Create Fake Materials: Fake Website (spoofed news pages, fabricated articles)	F1020.002
Initial Access	Impersonate Official (real news-brand impersonation)	F1032
Monetization	Ad-arbitrage revenue (no matching child technique)	FA0002

The monetization row is a deliberate flag rather than a forced mapping: FA0002 is the correct parent tactic, but its listed child techniques (electronic funds transfer, crypto conversion, fraudulent purchasing, gambling) do not describe display-ad arbitrage. Ad fraud is a real coverage gap in a financial-fraud framework.

Conclusion

This operator has already shown what it does under pressure: when an apex accumulates reputation history, it registers a fresh one, carries the same subdomain-squat grammar across, and walks its advertiser personas over to the new destination. The rotation domains sitting in reserve suggest the next apex is a question of when, not whether. The durable signal is not any single domain but the shape of the thing: real news brands to the left of the dot, an unrelated coined word to the right, dozens of brand-labeled subdomains under one roof, and fan-page ads whose personas have nothing to do with what they are selling. Watching for advertiser personas that jump to a newly registered apex is the earliest place to catch the next generation.