onefootball[.]fit

onefootball.fit was registered on 2026-04-10 through PublicDomainRegistry.com (PDR Ltd.). The domain resolves to 172.67.208.192, an address owned by Cloudflare, Inc. and is served from the Cloudflare network (nameservers konnor.ns.cloudflare.com and irma.ns.cloudflare.com). The site returns an HTTP 403 response and the page title is "Just a moment…", indicating that access is being blocked by Cloudflare's challenge page. SSL is provided by Let’s Encrypt (certificate identifier E8). The domain appears on one security blocklist and is referenced in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0/100, and the domain is actively blocked by PhishDestroy. Current intelligence classifies the site as a generic phishing infrastructure and marks it as active under investigation. No additional content has been publicly disclosed, and the exact phishing payload or targeted brand remains unknown. Defenders should block DNS resolution to the domain, add the IP address to network deny lists, and monitor for any related indicators such as the Cloudflare nameservers or the Let’s Encrypt certificate fingerprint. Continued observation is advised to capture any future changes in the site’s behavior or detection by additional threat feeds.