# PhishDestroy threat dossier — squidgrow-migrate.pages.dev ================================================================ Fetched: 2026-04-28 15:33:42 UTC Canonical: https://phishdestroy.io/domain/squidgrow-migrate.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Google ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 14/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, Chong Lua Dao, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Kaspersky, Lionic, Netcraft, Sophos, VIPRE, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: earl.ns.cloudflare.com, molly.ns.cloudflare.com Registered: 2026-04-27 Page title: SquidGrow Migration HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-07-26 Status: INVALID chain Fingerprint: e9a52c11bccf1ce92963a01cf35dd88043899d200f9e0f8803b22531e59f7be8 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-27 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-27 11:13:33 UTC (by PhishDestroy tracker) Last verified: 2026-04-28 13:40:04 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dcdfe-386d-710d-bbc5-d34ca6614f1f/ Wayback Machine: https://web.archive.org/web/*/squidgrow-migrate.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.squidgrow-migrate.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=squidgrow-migrate.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/squidgrow-migrate.pages.dev URLhaus: https://urlhaus.abuse.ch/host/squidgrow-migrate.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-27 11:14:30 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, squidgrow-migrate.pages.dev, is an active phishing site hosted on Google Pages and delivered through Cloudflare infrastructure. The site is designed to trick users into entering sensitive credentials, posing as a migration tool. PhishDestroy identifies this as a credible threat vector targeting unaware users who may confuse legitimate Google Pages subdomains with fraudulent ones. The campaign exploits the trust in Google’s hosting platform while leveraging Cloudflare’s fast CDN to obscure malicious infrastructure, making detection and takedown more difficult. The domain currently shows no detections on VirusTotal despite its active status, indicating a low-profile operation that may evade traditional security measures. This domain was flagged through continuous monitoring of Google Pages subdomains used in unauthorized campaigns. According to investigative data, squidgrow-migrate.pages.dev resolves to IP address 188.114.96.3 and operates with an SSL certificate issued by Google Trust Services, which adds a layer of false legitimacy. VirusTotal analysis shows 0 detections out of 95 security vendors at the time of discovery, reflecting the stealthy nature of the campaign. The domain is registered through Cloudflare, Inc., which is often used by threat actors to hide origin servers behind proxy networks. The presence of a Google-hosted page is a deliberate tactic to bypass email filters and user skepticism, as many users associate *.pages.dev with legitimate Google services. If you have visited squidgrow-migrate.pages.dev or interacted with its content, immediately cease use of any credentials entered on the site. Disconnect from all active sessions and change passwords for accounts potentially exposed, prioritizing email and financial services. Scan your device for malware using updated antivirus software, as secondary payloads could have been delivered through the page. Report the domain to your email provider, browser security teams, and threat intelligence platforms such as VirusTotal or PhishDestroy to aid in blocking and investigation. Avoid accessing the site further, as it remains active and poses ongoing risk to users who may be redirected through compromised channels or malicious ads. Always verify the legitimacy of migration or tool-related pages by checking official domains and using secure bookmarks for critical services. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 2012950f94a4fe6185f5e69c125dc55e TLS cert SHA-256: e9a52c11bccf1ce92963a01cf35dd88043899d200f9e0f8803b22531e59f7be8 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/squidgrow-migrate.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=squidgrow-migrate.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io