maclasse2025[.]fr

Analysis of maclasse2025.fr, created on February 21 2026, shows a short‑lived infrastructure that was taken offline prior to the report date of July 24 2026. The domain resolves to IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) and geolocated to the United States. DNS data lists ns1.amenworld.com and ns2.amenworld.com as authoritative nameservers, and the MX record points to mail-fr.securemail.pro with a priority of 10, suggesting a functional mail set‑up that could have been used for credential harvesting. The site presented the page title "Ma Classe 2025" and was served over an SSL certificate identified as WE1, indicating that TLS was provisioned despite the brief operational window.

Reputation signals are mixed: the domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans recorded four positive detections out of ninety‑five antivirus engines, confirming that at least a subset of security products flagged the site as malicious. The limited exposure, recent registration, and rapid takedown are consistent with a targeted generic phishing campaign.

Uncertainty remains around the exact phishing kit employed and any secondary payloads that may have been delivered before the site was taken offline, as no additional forensic artifacts have been disclosed. Defenders should continue to block the domain and its associated IP address at perimeter and endpoint layers, monitor for any resurgence of the same nameserver or MX configurations, and consider adding the observed MX host to email filtering rules. Ongoing threat‑intel feeds should be consulted for any re‑use of the Cloudflare IP range in similar campaigns, and incident response teams should verify that no credentials from the "Ma Classe 2025" theme have been compromised in their environment.