# war-migrations.info — SUSPICIOUS

> war-migrations.info poses a medium phishing risk targeting token migrations. Avoid interacting with this site and verify URLs carefully to stay safe.

## Summary
PhishDestroy identifies war-migrations.info as an active phishing domain with a medium risk level. Classified under generic phishing, this domain aims to deceive users by impersonating a token migration platform, potentially to steal sensitive credentials or tokens.

Supporting evidence includes its registration date on March 13, 2026, and association with NiceNIC International Group Co., Limited. The domain resolves to IP address 188.114.97.3 and currently appears on one security blocklist. VirusTotal flags this domain by 3 out of 95 security vendors, indicating a moderate detection rate consistent with phishing activity. The page title 'Migrate.fun - Token Migration Platform' suggests a fraudulent lure to trick users involved in cryptocurrency token migrations.

Users should avoid visiting war-migrations.info and refrain from entering any personal or financial information. Security teams are advised to block this domain at network perimeters and monitor for related phishing attempts. The domain remains active, underscoring the importance of continued vigilance against its deceptive tactics.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP 530)
- Page title: Migrate.fun - Token Migration Platform

## Domain Intelligence
- Registered: 2026-03-13 03:07:02
- Expires: 2027-03-05 09:23:57
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ignacio.ns.cloudflare.com liberty.ns.cloudflare.com
- SSL Issuer: Let's Encrypt / E7

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["Fortinet", "Gridinsoft", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce543-40a2-73cd-adfd-b9f6d60a0c7d.png
- PhishDestroy: https://phishdestroy.io/domain/war-migrations.info/
- LLM endpoint: https://phishdestroy.io/domain/war-migrations.info/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/war-migrations.info/
Last updated: 2026-03-19