dofus-dofus[.]com

Analysis of dofus-dofus.com indicates a brand‑impersonation infrastructure targeting the Fortnite brand. The domain was registered on 18 October 2025 through Dynadot LLC and uses the authoritative name servers ns1.dyna‑ns.net and ns2.dyna‑ns.net. DNS resolution points to 172.86.117.247, an address owned by RouterHosting LLC (AS14956) located in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP only. The page title returned from the live host—“Parchemin Klutram ‑ Récompense ‑ Dofus, le MMORPG stratégique.”—does not reference Fortnite, but the domain is explicitly listed as impersonating Fortnite in the supplied intelligence.

Reputation data show the domain appears on a single security blocklist and has been blocked by the PhishDestroy sink‑hole. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports 15 of 95 scanned security vendors flagging the domain as malicious. AlienVault OTX contains the domain in 17 distinct threat‑intel pulses, indicating repeated observation across multiple feeds. The domain’s current status is offline, suggesting takedown or temporary suspension.

Uncertainty remains regarding the exact phishing payload or credential‑capture mechanisms, as the page content beyond the title has not been publicly disclosed. Defenders should update perimeter filters to block both the domain name and its resolving IP address, enforce TLS inspection to detect any future HTTPS activation, and monitor for newly registered look‑alike domains using the same registrar and name‑server patterns. Continuous ingestion of OTX and blocklist feeds is recommended to capture any re‑appearance of the indicator. Incident response teams should also verify that internal endpoints have not communicated with the domain prior to its takedown.