migrate-leash[.]com

migrate-leash.com is currently listed as offline but remains of interest to threat analysts because it was observed hosting a generic phishing landing page titled “Nur einen Moment…”. The domain was registered on 17 October 2025 through NiceNIC International Group Co., Limited and points to the IP address 188.114.96.3, which is announced by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. DNS resolution uses the Cloudflare nameservers clay.ns.cloudflare.com and emma.ns.cloudflare.com, indicating that the attacker leveraged Cloudflare’s CDN and DNS services to hide the true origin of the server. The site lacks an SSL/TLS certificate, which may have been a deliberate choice to avoid certificate‑validation warnings or simply reflects a rapid deployment that did not obtain encryption.

Threat intelligence feeds have recorded the domain on a single security blocklist, and PhishDestroy has actively blocked it. VirusTotal analysis shows that three out of ninety‑five scanners flagged the domain, confirming that at least a subset of automated detection tools consider it malicious. No additional public reputation scores or Safe Browsing entries are referenced in the supplied data. Because the domain is already taken offline, investigative opportunities such as content capture or credential harvesting verification are limited.

However, the presence of the Cloudflare infrastructure, the lack of TLS, and the modest detection count suggest a short‑lived campaign that relied on quick DNS provisioning and rapid takedown. Defenders should continue to monitor the associated IP address 188.114.96.3 for any future domains that resolve to the same host, update firewall and proxy rules to block traffic to that address, and ensure that any inbound requests to the Cloudflare nameservers are inspected for anomalous activity. In addition, security teams should add migrate‑leash.