vwww-ankama[.]com

Analysis indicates that the domain vwww-ankama.com was registered on 21 February 2026 and is currently offline. The site served a page titled “pack osavora - Maj - Actualités - DOFUS, le MMORPG stratégique.” Although the title references the DOFUS MMORPG, the domain is classified as a social‑media phishing vector that impersonates the Discord brand. The hosting IP resolves to 45.148.121.52, an address belonging to SpectraIP B.V. in the Netherlands (AS62068). TLS termination is provided by a ZeroSSL RSA Domain Secure Site CA certificate, a free certificate often used by malicious operators.

Threat‑intel aggregation shows the domain appearing in fourteen AlienVault OTX pulses and on a single public blocklist; it is also listed by PhishDestroy. VirusTotal scans reported eight detections out of ninety‑five antivirus engines, confirming a moderate level of detection across the security ecosystem. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The combination of a brand‑impersonation claim, a Discord‑focused phishing classification, and the observed infrastructure points to a campaign designed to lure Discord users to a counterfeit login or credential‑harvesting page.

At present, the exact content of the page has not been captured, and the malicious payload or credential‑collection mechanisms remain unknown. Defenders should proactively block the domain and its resolving IP at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of the host, and incorporate the Indicator‑of‑Compromise (IoC) details – domain name, IP address, SSL fingerprint, and associated OTX identifiers – into threat‑intel feeds. Continuous verification of the domain’s status and periodic rescans are recommended to capture any changes in its operational posture.