# PhishDestroy domain threat record: efootball-manager.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/efootball-manager.ru/
Machine-readable companion: https://phishdestroy.io/domain/efootball-manager.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-07 04:40:19 UTC
- Last availability or vendor check: 2026-10-22 10:37:34 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 159.194.214.136
- Registrar in stored WHOIS data: BEGET-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-10 06:16:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a114a8-b3dd-73de-847b-9870b46b9bbe/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/efootball-manager.ru
- Certificate Transparency search: https://crt.sh/?q=%25.efootball-manager.ru
- Web Archive lookup: https://web.archive.org/web/*/https://efootball-manager.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
efootball-manager.ru is a domain on the PhishDestroy blocklist that presents itself with the page title "eFootball Manager", borrowing the name of the eFootball football game. That name makes eFootball players and fans the most likely audience. PhishDestroy first saw it on 2026-10-07, and it was still online and serving content when last checked on 2026-10-19.

How the scam works
PhishDestroy has not yet attached a specific scheme to this site, so the risk comes from what it shows: an unofficial ".ru" address carrying a game brand in its title. Sites like this often pose as companion tools, team managers or reward hubs. They then ask players to sign in with their game or platform account, hand over personal details, or pay for in-game items and bonuses that never arrive. Anyone who interacts with it could lose account access, login credentials or money sent through the page.

Evidence
Independent detection is limited but real. Five of 92 VirusTotal engines flagged the domain as of 2026-10-19: CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. Most engines have not caught up, so a clean result from a single scanner means little here. The domain also appears in four AlienVault OTX threat pulses, which shows other researchers are tracking it. Among blocklists, it is currently listed by PhishDestroy.

Infrastructure
The domain was registered on 2026-07-10 through BEGET-RU, about three months before PhishDestroy detected it. It is hosted on Beget LLC's network in Russia, with the registration and hosting kept with the same Russian provider. The site uses a free Let's Encrypt certificate. The padlock in the browser only means the connection is encrypted and says nothing about whether the site can be trusted.

What to do
If you signed in on this site with a game, console or platform account, change that password right away. Change it anywhere else you reuse it too, then turn on two-factor authentication and review recent sign-ins and linked devices. If you entered card details or paid for anything, contact your bank to dispute the charge and watch for further transactions. Use only official eFootball channels and app stores for game services. Security teams should block the domain at DNS and proxy level and check logs for users who visited it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a114a8-b3dd-73de-847b-9870b46b9bbe/
VirusTotal report: https://www.virustotal.com/gui/domain/efootball-manager.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=efootball-manager.ru
Archived copy: https://web.archive.org/web/20261009134923/https://efootball-manager.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:42:35 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qMDT0SpH/c45e084ac9b2.png
  Captured: 2026-10-07 04:40:19 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a114a8-b3dd-73de-847b-9870b46b9bbe.png
  Captured: 2026-10-07 04:40:19 UTC
  Source report: https://urlscan.io/result/01a114a8-b3dd-73de-847b-9870b46b9bbe/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ee12b6df-375e-4d34-bc18-e95b87d27263.png
  Captured: 2026-10-07 05:14:14 UTC
  Source report: https://radar.cloudflare.com/scan/ee12b6df-375e-4d34-bc18-e95b87d27263
  SHA-256: c7de8549b20f8972598ca6b09592aa51054e9e667f8b2168f42b4f4d9173e605
- URLQuery: https://screenshots.phishdestroy.io/uq/23c7cff7-3be3-4113-9e8f-b20cf5c8a328.png
  Source report: https://urlquery.net/report/23c7cff7-3be3-4113-9e8f-b20cf5c8a328
  SHA-256: 7c45ca8ec6bde6198ccd07c5de7e3a95ff5c7d8773b8dbc76ed879878c735d05
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a114a1-4645-7622-9526-dfba4da1c6df.png
  Captured: 2026-10-07 04:31:22 UTC
  Source report: https://urlscan.io/result/01a114a1-4645-7622-9526-dfba4da1c6df/
  SHA-256: 9b3d96e0707d7b468f74154e0d617e3da110fdf0155bd334d217fc03e2282959
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a114a4-175e-713b-a232-f2ca91ff5cbc.png
  Captured: 2026-10-07 04:34:27 UTC
  Source report: https://urlscan.io/result/01a114a4-175e-713b-a232-f2ca91ff5cbc/
  SHA-256: f31060724b431c01b50fd557f33f3ead02a8b7d0462d9945c689bcaab34ea33e
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a114a4-a6cb-749a-9f65-689344c044e5.png
  Captured: 2026-10-07 04:35:07 UTC
  Source report: https://urlscan.io/result/01a114a4-a6cb-749a-9f65-689344c044e5/
  SHA-256: 9b3d96e0707d7b468f74154e0d617e3da110fdf0155bd334d217fc03e2282959

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:27:53Z",
        "uuid": "01a114a8-b3dd-73de-847b-9870b46b9bbe",
        "scanned_at": "2026-10-07T04:39:29Z",
        "final_url": "https://efootball-manager.ru/",
        "status": 200,
        "ip": "159.194.214.136",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.13.94",
            "2a00:1450:4001:c21::5f",
            "159.194.214.136"
        ],
        "asns": [
            "15169",
            "198610"
        ],
        "countries": [
            "US",
            "DE",
            "RU"
        ],
        "link_domains": [
            "t.me"
        ],
        "social": [
            "https://t.me/Arbitalcode"
        ],
        "doc_hash": "41a40c7f78f2ca7c506858bbdbce3180012f57354e16e6d1e7a533847e3bad7f",
        "script_hashes": [
            "2136202b008dd282812005684893553bb0ef7a9585cd82e5b9bbdbf2bdf0a3fc"
        ],
        "storage_keys": [
            "pesmanager:theme:last"
        ],
        "tls": {
            "san": [
                "efootball-manager.ru",
                "www.efootball-manager.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "efootball-manager.ru",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-15T19:19:15Z",
            "valid_from": "2026-09-16T19:19:16Z"
        },
        "domain_age_days": 88,
        "apex_age_days": 88,
        "tls_age_days": 20,
        "tls_valid_days": 89,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.24.0 (Ubuntu)",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "Express"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:37:42Z",
        "uuid": "ee12b6df-375e-4d34-bc18-e95b87d27263",
        "scanned_at": "2026-10-07T05:14:14Z",
        "final_url": "https://efootball-manager.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://efootball-manager.ru/",
                "status": 200
            }
        ],
        "dom_hash": "9afaad00f39a137821206fc15a085ac885b1d6ab2e5e44f1ec9f3d78ea454e9a",
        "doc_hash": "41a40c7f78f2ca7c506858bbdbce3180012f57354e16e6d1e7a533847e3bad7f",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "efootball-manager.ru",
                "type": "A",
                "value": "159.194.214.136"
            }
        ],
        "dnssec_valid": false,
        "ip": "159.194.214.136",
        "whois": {
            "registrar": "BEGET-RU",
            "created": "2026-07-10T08:16:58Z",
            "expires": "2027-07-10T08:16:58Z",
            "nameservers": [
                "ns1.beget.com",
                "ns1.beget.pro",
                "ns1.beget.ru",
                "ns2.beget.com",
                "ns2.beget.pro",
                "ns2.beget.ru"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T10:26:29Z",
        "analysis_at": "2026-10-19T02:00:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "BEGET-RU",
        "first_seen": "2026-07-10T18:18:20Z",
        "dns": [
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 redirect=beget.com"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.beget.ru"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.beget.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "159.194.214.136"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.beget.pro"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=YhM4_iKWRD7MYzTlAFQUcX478go_u2lur5DQdn6RNiM"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.beget.pro"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.beget.com",
                "value": "ns1.beget.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "mx2.beget.com",
                "priority": 20
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.beget.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "mx1.beget.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.beget.ru"
            }
        ],
        "dns_at": "2026-10-19T02:00:53Z",
        "jarm": "27d40d40d00040d00042d43d000000d2e61cae37a985f75ecafb81b33ca523",
        "cert": {
            "san": [
                "efootball-manager.ru",
                "www.efootball-manager.ru"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6a212da951a72e7fe38060f62bfd4f09616",
            "sha256": "34d11fba1e085cedf6db32f02a2dbe22d75e5ea043c890d0d56ac48d13e80c34",
            "subject": "efootball-manager.ru",
            "valid_to": "2026-12-15T19:19:15Z",
            "valid_from": "2026-09-16T19:19:16Z"
        },
        "whois": {
            "registrar": "BEGET-RU"
        }
    }
}
```