migrate-goneural[.]xyz

This domain, migrate-goneural.xyz, is currently under investigation for high-risk phishing activity. Registered on October 30, 2025, through OwnRegistrar, Inc., the domain remains active as of July 12, 2026, and is flagged by one security blocklist. Analysis indicates the domain resolves to the IP address 188.114.97.3, which is associated with AS13335, a network operated by Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, specifically under the WE1 intermediate, and the domain utilizes Cloudflare nameservers (aiden.ns.cloudflare.com and lila.ns.cloudflare.com). Infrastructure analysis reveals the use of Cloudflare Browser Insights and HTTP/3, suggesting an attempt to leverage modern web technologies for obfuscation or performance optimization. The domain returns an HTTP 403 status, indicating access is forbidden, which may be a deliberate tactic to evade automated scanning or analysis. The page title, 'Nur einen Moment…,' does not provide definitive evidence of the intended target or phishing kit, though the phrase is commonly associated with intermediate loading or redirect pages in phishing campaigns. VirusTotal reports that 3 out of 95 security vendors have flagged this domain as malicious, a relatively low detection rate that may reflect either evasion techniques or recent activation. The domain's trust score, as assessed by Gridinsoft, is 0 out of 100, further corroborating its suspicious nature. Defenders should treat this domain as high-risk and consider blocking it at the DNS or network level, particularly in environments where Cloudflare-hosted domains are not typically whitelisted. Additional monitoring is recommended to determine if the domain transitions to an active phishing state or exhibits further malicious behavior.