dogehero[.]pro

Analysis indicates that the domain dogehero.pro was actively used to host a phishing campaign impersonating cryptocurrency mixing services, as reflected in the page title “Dogecoin Mixer | Dogecoin Blender | DOGE Mixer | DOGEHERO”. The site was registered via GoDaddy.com, LLC and delegated to the authoritative name servers ns07.domaincontrol.com and ns08.domaincontrol.com. DNS resolution points to 92.205.1.212, an address announced by AS21499 Host Europe GmbH located in France. The hosting environment runs Apache HTTP Server with PHP, Bootstrap and AngularJS, and enforces HTTP Strict Transport Security. A valid Let’s Encrypt R12 certificate was presented, suggesting the site employed TLS but did not mitigate the malicious purpose.

The domain appears on four external security blocklists and has been flagged by multiple industry‑wide mitigation services, including PhishDestroy, Polkadot, Enkrypt and Codeesura. AlienVault OTX lists the domain in 17 separate threat‑intel pulses, indicating repeated observation across different feeds. VirusTotal recorded four detections out of ninety‑five scanned scanners, reinforcing the malicious classification. The Gridinsoft trust score of zero further confirms the lack of reputational confidence. Mail exchange is configured for mail.dogehero.pro, but no additional mail‑related abuse has been reported.

The site’s current HTTP status is offline, meaning the content is no longer reachable, yet the infrastructure artifacts remain observable and may be reused. Uncertainty remains regarding the exact payload delivered to victims, as the page content has not been captured in this assessment. Defenders should continue to block the domain and its associated IP address at perimeter and DNS layers, monitor for re‑registration or reuse of the same hosting resources, and apply threat‑intel feeds that reference the listed blocklist identifiers.