clubs-onefootball[.]app

This report details a domain engaged in an Account Takeover scam, as indicated by the scam type data. The site's page title is "Account Suspended," and the domain name suggests it is related to the "OneFootball" brand. The threat posed is that the site is likely designed to trick users into providing account credentials, leading to unauthorized access and account compromise.

Technical analysis shows the domain has a VirusTotal detection rate of 5 out of 95 vendors, with detections by CRDF, Fortinet, G-Data, Gridinsoft, and SOCRadar. It appears on 2 blocklists. The domain is hosted on IP address 37.16.75.129, located in the Netherlands, under AS43641 SOLLUTIUM EU Sp z.o.o. The registrar is PL-SOLLUTIUM-20210802, with an ASN of 43641. The domain uses nameservers ns3-ams.v-sys.org and ns4-ams.v-sys.org, and has no SSL certificate. The creation date is derived from the registrar string as 2021-08-02.

The current status of the site is SUSPENDED, indicating it is no longer accessible. Given the detection by multiple security vendors and its presence on blocklists, the risk level is assessed as high. Users who may have interacted with this domain should consider their accounts potentially compromised.