Possible compromised signup/payment flow

[cscottrun4it]

I attempted to sign up via the site and was routed to a payment page requesting a credit card, despite the tier being advertised as free. After entering card details, unrecognized charges from several unrelated "tech-sounding" merchant names appeared on my account.

Path I took: https://collegefootballdata.com/exporter?team=Michigan&year=2026#google_vignette -> https://believesport.com/offers/sport22/?utm_source=google&utm_medium=cpc&utm_campaign=21346546031&utm_content=collegefootballdata.com&m=a3&gad_source=5&gad_campaignid=21346546031&gclid=EAIaIQobChMI5_bS-8vxlgMVyRSMBh3J1wqcEAEYASAAEgKgKPD_BwE

URL the payment page was on: https://checkout.sportsbowl.com/a3/?uid=44340628&_gl=&receipt=1

Two questions: is the direct API key page at /key affected by this, and should keys issued around this time be revoked and regenerated?

[cscottrun4it]

Follow-up with the specific detail requested.

The payment page I was routed to was on a third-party domain, not CFBD:

checkout.sportsbowl.com/a3/?uid=[redacted]&receipt=1

This is neither Gumroad (where the packs are sold) nor Patreon (where the API tiers are billed), which as I understand it are the only two payment destinations CFBD uses. It asked for a credit card. After entering it, charges from several unrelated merchant names began appearing on the account.

I want to be clear about what I'm not claiming: I can't tell from my side whether something on collegefootballdata.com routed me there, or whether I arrived via a sponsored search result or a lookalike page. That distinction is exactly why I'm reporting it — it's checkable from your side and not from mine.

Noting also that per the /key page, the free tier requires no credit card at all: submit an email, key gets emailed. So whatever sent me to a checkout was diverting from a process that is free by design.

Is there any link or redirect on the site that could route a user to this domain?

As I ask in my first post, should API keys issued during this window be regenerated as a precaution?

Happy to send the merchant names and timestamps privately if that's useful. The card has been cancelled, so there's no ongoing exposure on my end — I'm reporting it in case other users are hitting the same path.