fr-dofus[.]com

Analysis of www.fr-dofus.com indicates that the domain was registered on 12 December 2025 through Dynadot LLC and is hosted on IP 144.172.109.57, which belongs to AS14956 RouterHosting LLC in the United States. The domain lacks an SSL/TLS certificate, and HTTP requests return a 404 Not Found page title, suggesting that the site is currently offline. Infrastructure checks show that the domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal scans have flagged the domain in 8 of 93 antivirus and URL‑reputation engines, reinforcing the suspicion of malicious activity. The Gridinsoft trust score of 0 out of 100 further reflects a low reputation. AlienVault OTX records the domain in fifteen distinct threat‑intel pulses, indicating that it has been observed by multiple researchers. Nameserver resolution points to ns1.dyna-ns.net and ns2.dyna-ns.net, both associated with Dynadot’s DNS service.

The available evidence aligns with the classification of a generic phishing operation, although no specific phishing landing page content has been captured. The 404 response prevents direct observation of the payload, leaving the exact phishing vector and targeted brand undefined. Consequently, the precise tactics, techniques, and procedures (TTPs) employed by the actors remain uncertain.

Defenders should continue to block resolution of www.fr-dofus.com at the network perimeter and update any URL filtering lists with the domain and its associated IP address. Monitoring of the hosting ASN (AS14956) for new domains that share similar registration patterns is recommended. Because the domain is already offline, threat‑intel sharing platforms should be notified to maintain the current blocklist entries and to propagate the OTX pulse references. Organizations using DNS‑based filtering should ensure that the domain’s nameservers are also denied if they are not required for legitimate traffic.