boutiques-dofus[.]fr

This domain is flagged as an elevated-risk credential harvesting phishing site designed to deceive users of the MMORPG Dofus. Analysis indicates the site impersonates official reward pages, specifically targeting players through the false "Grimoire Drunyx - Récompense" offer to extract login credentials and account details. The threat type aligns with generic_phishing but exhibits targeted social engineering tactics common in gaming fraud. Infrastructure analysis reveals the domain was registered on February 02, 2026, through Dynadot LLC, an uncommon registrar for legitimate gaming platforms. It resolves to IP address 104.194.155.9, hosted in Singapore under AS14956 (RouterHosting LLC), with no SSL certificate present. Detection metrics show 15 out of 95 security vendors on VirusTotal flagged the domain, while it appears on one security blocklist (PhishDestroy). The domain currently remains offline, though historical resolution patterns suggest intermittent availability. Mitigation requires immediate blocking of the IP 104.194.155.9 at network perimeters and addition of the domain to enterprise phishing filters. Users should verify reward legitimacy through official game channels and enable multi-factor authentication on gaming accounts. Organizations should monitor for credential reuse attempts from harvested accounts, particularly those associated with MMORPG platforms. The creation date discrepancy (2026) further indicates domain spoofing, warranting heightened scrutiny of similarly structured domains.