onefootball-tge[.]com

This domain presents an elevated risk level due to brand impersonation specifically targeting Google. The threat type is phishing, where the domain mimics a legitimate Google-branded service to deceive users into disclosing sensitive information or installing malicious payloads. The page title 'onefootball' suggests an attempt to combine a sports-related name with Google's branding to increase credibility and lure visitors.

Technical indicators confirm the malicious nature of this domain. VirusTotal reported 3 out of 95 security vendors flagging this domain as malicious. It was created on November 11, 2025, registered through OwnRegistrar, Inc., and resolves to IPv6 address 2a00:1450:4001:830::200e. The domain uses Cloudflare for CDN and HTTP/3 protocol, with an SSL certificate issued by Google Trust Services. It appears on 2 security blocklists and has a Gridinsoft trust score of 0 out of 100. Blocking services ScamSniffer and PhishDestroy already flagged this domain. The domain is currently offline.

To mitigate this threat, users should avoid visiting any URLs associated with onefootball-tge.com. Organizations should add this domain to web filter blacklists and monitor network logs for connections to 2a00:1450:4001:830::200e. Since it impersonates Google, users should verify any email or message claiming to be from Google that references this domain. Security teams should also review OwnRegistrar, Inc. registrations for similar threats and ensure Cloudflare and Google Trust Services certificates are validated in proxy environments to detect impostor domains.