dofus-retro-ankama[.]com

This domain www.dofus-retro-ankama.com was identified as a brand‑impersonation site targeting Discord users. The site was created on 21 February 2026 and is registered through NameCheap, Inc. It resolves to the IP address 198.54.114.248, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. The authoritative nameservers are dns1.namecheaphosting.com and dns2.namecheaphosting.com. No TLS certificate is presented, indicating that the site is served over plain HTTP. The page title returned by the HTTP response is “DOFUS RETRO - Caveau bworkeralien - DISPONIBLES EN JEU!”, which does not reference Discord but confirms that the content is unrelated to the claimed brand.

The domain is currently taken offline, and the blocklist entry shows that it has been removed from public access. Detection data shows that PhishDestroy has blocked the domain and that Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded three detections out of ninety‑three scanned vendors, and AlienVault OTX lists the domain in one threat‑intel pulse. It appears on a single security blocklist. These indicators collectively confirm that the domain was used for malicious brand impersonation, although the exact payload or credential‑harvesting mechanism has not been observed.

Uncertainty remains regarding the specific phishing vector employed, the extent of user interaction, and whether any credentials were exfiltrated before the takedown. No evidence of a login page, redirect, or malware drop has been disclosed. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed IP and hostnames, and monitor for any residual traffic to 198.54.114.248. Incident response teams should also audit accounts for unauthorized Discord activity and advise users to verify any unexpected communications that reference Discord.