dofus-retro-com[.]fr

The domain dofus-retro-com.fr was registered on March 22, 2026 through Hosting Concepts B.V. d/b/a Openprovider and is hosted on infrastructure owned by Alexhost SRL in Moldova. DNS resolution points to IP address 176.123.0.55 and the authoritative nameservers are ns3.alexhost.md and ns4.alexhost.md. The web server reports Nginx with OpenResty, and the TLS certificate is a Let’s Encrypt R12 certificate. The only observed HTML element is the page title “One moment, please…”, and the domain is currently taken offline.

VirusTotal records three positive detections out of ninety‑four scanners, indicating that a minority of security engines have flagged the host as malicious. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one public blocklist. Independent monitoring by PhishDestroy also lists the domain as blocked. The intelligence feed classifies the activity as a “Gaming Scam”, matching the domain’s reference to the game Dofus.

The evidence confirms that the domain is part of a recent phishing campaign targeting gamers, but the lack of additional contextual data—such as the specific payload, landing‑page content, or victim reports—prevents a full reconstruction of the attack vector. Analysts should treat the domain as malicious and incorporate its IOCs into detection rules. Recommended actions include adding the IP address 176.123.0.55 and the two Alexhost nameservers to network‑level block lists, updating URL filtering with the full domain, and monitoring the Let’s Encrypt certificate fingerprint for any re‑issuance. Continuous observation of VirusTotal and other aggregation services is advised to capture future detections that may raise the confidence level.