onefootballclubairdrop[.]xyz

This website, onefootballclubairdrop.xyz, presented itself as a token airdrop platform with the title "OneFootball Club - Token Airdrop | Claim Your OFC Rewards." It was categorized as an airdrop scam and impersonated the brand ethereum. The primary threat was that it likely attempted to trick visitors into connecting their cryptocurrency wallets or providing credentials under the false promise of free tokens, which would result in asset theft.

Technical evidence shows the site was flagged by 8 out of 95 VirusTotal vendors, including alphaMountain.ai, BitDefender, Forcepoint ThreatSeeker, Fortinet, and G-Data. It was registered on 2025-10-14 with Ultahost, Inc., and hosted on IP address 45.12.2.67 (AS6698 Virtual Systems LLC) in Ukraine. The site had no SSL certificate and used nameservers including ns1.arciumairdrop.xyz. It was present on one blocklist.

As of the report, the domain is offline and down. Its risk score is 25, indicating a low to moderate threat level given its current inactive state, though it remains a documented malicious resource.