doverra[.]pro

This domain is flagged as an active crypto credential harvester targeting users through deceptive login interfaces. Analysis indicates the site employs advanced evasion techniques, including Firebase backend infrastructure and HTTP/3 protocol support, to bypass traditional security controls and persist undetected. Infrastructure analysis reveals the domain doverra.pro was registered through MEEBO (ASN: 54113) and resolves to IP address 199.36.158.100. Security vendors on VirusTotal detect the domain at 4/95, indicating low but non-zero coverage. The site appears on one security blocklist and is actively blocked by endpoint protection systems. Gridinsoft trust score is 0/100, confirming malicious classification. Detected technologies include Firebase for backend operations, jsDelivr for content delivery, and HTTP Strict Transport Security (HSTS) alongside HTTP/3, suggesting an attempt to appear legitimate while maintaining operational stealth. Mitigation requires immediate blocking of the domain and associated IP at network perimeter devices. Security teams should monitor for credential reuse attempts from harvested accounts, particularly in cryptocurrency wallets and exchange platforms. Endpoint detection rules should be updated to flag any outbound connections to 199.36.158.100 or domains registered through MEEBO with similar technology stacks. User awareness training should emphasize verification of login interfaces for cryptocurrency services, including checking for unexpected Firebase or jsDelivr resources in page sources.