classe2025[.]fr

The domain classe2025.fr was registered on July 10, 2025 through KEY-SYSTEMS GmbH and is currently marked as offline. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Both authoritative nameservers, harley.ns.cloudflare.com and maya.ns.cloudflare.com, are Cloudflare‑managed, indicating that the infrastructure is hosted behind Cloudflare’s edge network. No TLS certificate was observed, meaning the site served traffic without encryption.

The sole page title retrieved from the site was "MaFicheClasse," providing no clear indication of the intended victim brand or service. Trust‑rating services assign extremely low scores: Scamadviser rates the domain 1 out of 100 and Gridinsoft scores it 0 out of 100, reflecting a consensus of high risk. The domain appears on a single security blocklist and has been flagged by PhishDestroy, confirming that it has been recognized by at least one anti‑phishing service. VirusTotal analysis shows that 12 of 95 security vendors submitted a detection for the domain, reinforcing the malicious assessment.

Additionally, AlienVault OTX lists the domain in one threat‑intelligence pulse, linking it to broader malicious activity. While the exact phishing landing page content is not publicly documented, the combination of low trust scores, Cloudflare‑based hosting without TLS, multiple vendor detections, and blocklist inclusion strongly suggests the domain was used for a generic phishing campaign. Defenders should continue to block the domain at perimeter and endpoint controls, monitor DNS queries for the associated IP and nameservers, and ingest the indicator into threat‑intel feeds. Ongoing observation is recommended to detect any re‑activation or repurposing of the same infrastructure.