dogecoincasino[.]nl[.]traffborris1[.]org

Analysis of dogecoincasino.nl.traffborris1.org shows a newly registered domain (created 20 January 2026) that resolves to the IP address 185.174.173.12. The domain is hosted by NAMECHEAP INC and uses the Ukrainian nameservers dns1.hyperhost.ua and dns2.hyperhost.ua. VirusTotal records indicate the domain was scanned by 91 security vendors, none of which raised a detection; this lack of alerts does not constitute a safety guarantee and should be interpreted as a neutral result pending further investigation.

The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that at least one security feed has classified the site as malicious. No public Safe Browsing, OTX, or SSL certificate details are available in the current intelligence set, and the HTTP response status has not been disclosed. The observed infrastructure—recent registration, use of a shared hosting provider, and association with a known phishing blocklist—aligns with typical patterns of generic phishing campaigns that exploit cryptocurrency‑related branding.

Defenders should consider immediate mitigation actions: add the domain and its resolved IP address to network‑level deny lists, enforce DNS filtering against the listed nameservers, and monitor traffic for any connections to 185.174.173.12. Continuous re‑scanning with multi‑vendor services is advised to capture any future malicious payloads that may be uploaded to the site. Until further behavioral data is collected, the domain remains classified as an active phishing threat requiring proactive blocking.