# PhishDestroy threat dossier — migrate-akita.xyz ================================================================ Fetched: 2026-06-28 15:26:23 UTC Canonical: https://phishdestroy.io/domain/migrate-akita.xyz/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 77/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (US, San Francisco) Hosting org: AS13335 Cloudflare, Inc. Registrar: NameSilo, LLC !!! REGISTRAR INTEGRITY ALERT — NameSilo !!! NameSilo is a registrar documented by PhishDestroy as (1) publicly lying about received abuse reports, (2) shielding a $20M+ Monero-theft operation (xmrwallet.com) for 10 continuous years, and (3) retaliating against PhishDestroy by getting our X/Twitter account @Phish_Destroy banned after we published the evidence. Researchers/victims must ALWAYS CC compliance@icann.org on every abuse ticket — NameSilo has a track record of later claiming reports were never received. Primary sources: https://phishdestroy.io/namesilo-killed-our-twitter https://phishdestroy.io/xmrwallet-namesilo-exposed Nameservers: bowen.ns.cloudflare.com, dawn.ns.cloudflare.com Registered: 2026-06-21 Expires: 2027-06-21 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-24 21:23:46 UTC (by PhishDestroy tracker) First reported: 2026-06-24 19:30:53 UTC (abuse notice filed) Last verified: 2026-06-28 16:20:38 UTC Neutralised: 2026-06-25 03:04:03 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019efb15-d5a8-710b-81a0-d5d8c48099f7/ URLQuery: https://urlquery.net/report/70b97f74-989f-4964-95ce-03fcb7f1f9f7 Wayback Machine: https://web.archive.org/web/*/migrate-akita.xyz crt.sh CT logs: https://crt.sh/?q=%25.migrate-akita.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=migrate-akita.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/migrate-akita.xyz URLhaus: https://urlhaus.abuse.ch/host/migrate-akita.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-24 21:24:04 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies migrate-akita.xyz as a newly active fake migration scam website designed to trick users into divulging sensitive account credentials under the guise of a platform migration notice. This fraudulent domain mimics legitimate migration alerts from well-known services, tricking victims into entering login details on a spoofed interface. The page exploits urgency by claiming immediate action is required to transfer or secure accounts, a common tactic in phishing campaigns targeting users during platform transitions or updates. Technical analysis shows this site is part of a coordinated effort to harvest credentials across multiple platforms, with threat actors registering similar domains to cast a wide net. This domain was flagged with zero detections out of 95 VirusTotal engines as of analysis time, indicating it remains under the radar of most automated security systems. migrate-akita.xyz was registered on June 21, 2026, through NameSilo, LLC, and is hosted on Cloudflare infrastructure at IP 188.114.96.3. The use of Cloudflare nameservers (bowen.ns.cloudflare.com, dawn.ns.cloudflare.com) is a common tactic to mask malicious infrastructure behind reputable hosting, delaying detection and takedown efforts. The domain’s recent creation and clean record at the time of analysis suggest it is part of a fast-moving campaign targeting users anticipating or recently undergoing platform migrations. If you visited migrate-akita.xyz, immediately change your passwords on all accounts using the same or similar credentials, especially email and financial services. Do not use any information entered on the site. Enable multi-factor authentication (MFA) on critical accounts to add an extra layer of security. Report the domain to your organization’s security team or to PhishDestroy for further analysis. Monitor your accounts for unusual activity, such as unauthorized logins or transactions, and consider freezing credit reports if financial details were submitted. Share this warning with colleagues, family, or friends who may also encounter similar migration-themed scams. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260624-5CDE10 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/migrate-akita.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=migrate-akita.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,015 domains (13,989 alive under monitoring, 157,545 confirmed takedowns/dead). Site: https://phishdestroy.io