footlball[.]fun

On 24 July 2026, footlball.fun was observed as an offline phishing‑related artifact. The domain, registered on 21 February 2026 through NiceNIC International Group Co., Limited, resolves to the Cloudflare address 104.21.65.61, which is associated with Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare authoritative name servers alexa.ns.cloudflare.com and arnold.ns.cloudflare.com, and the site served HTTP/3 traffic protected by Cloudflare. An SSL certificate identified as “WE1” was presented, confirming the use of TLS.

Access attempts returned a HTTP 522 “Connection timed out” response, as reflected in the page title “footlball.fun | 522: Connection timed out”. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. VirusTotal analysis recorded a single detection out of ninety‑five scanning engines, indicating at least one vendor flagged the domain as malicious. No additional public intelligence—such as Safe Browsing, OTX, or detailed malware family attribution—has been published for this host.

Consequently, the precise phishing payload or targeted brand remains unverified. Defenders should add 104.21.65.61 to network deny lists, enforce blocking of footlball.fun at DNS resolvers, and monitor for any re‑activation of the domain or related sub‑domains. Continuous review of Cloudflare‑hosted IP reputation and periodic re‑scanning with multiple vendors are recommended to capture any future changes in malicious activity.