fotbalovavidea[.]cz

Analysis of the domain fotbalovavidea.cz indicates active credential-phishing infrastructure targeting Czech-speaking users. The domain, registered on December 10, 2015, through REG-INTERNET-CZ, currently resolves to IP address 91.239.201.13 within AS60606 (PRO-ZETA a.s.), located in the Czech Republic. Nameservers ns1.thinline.cz (91.239.200.243 and 2001:67c:e94:0:1:5bef:c8f3:1) are consistent with the hosting provider's network. The site presents an HTTP 200 status and uses a Let's Encrypt SSL certificate (R12), which does not inherently indicate malicious intent but is commonly exploited in phishing operations for perceived legitimacy. Detection data reveals the domain is flagged by seven of ninety-three security vendors on VirusTotal, including confirmed blocks by PhishDestroy and CryptoFirewall.

It appears on two security blocklists and has been referenced in six AlienVault OTX threat intelligence pulses, suggesting recurring malicious activity. The page title, 'Fotbalová videa,' implies content related to football videos, though the exact nature of the phishing mechanism—whether credential harvesting, malware distribution, or another vector—remains unconfirmed due to lack of deeper behavioral analysis. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification. Technologies detected include WordPress, MySQL, PHP, Nginx, and client-side libraries such as jQuery and Google Hosted Libraries, which are frequently used in both legitimate and malicious sites.

The combination of long-standing domain registration, active hosting, and multiple detection flags suggests this is not a short-lived campaign but rather an established phishing node. Defenders should prioritize blocking the domain and its resolving IP (91.239.201.13) at the network level. Monitoring for connections to the associated nameservers (ns1.thinline.cz) may also aid in identifying related infrastructure.