myro-migration[.]netlify[.]app

myro-migration.netlify.app is a Netlify‑hosted site that surfaced on February 21, 2026 and resolves to the Amazon‑owned address 98.84.224.111 in the United States (ASN14618). The TLS certificate presented is a DigiCert Global G2 RSA SHA‑256 chain issued in 2020, indicating that the domain was able to obtain a legitimate certificate despite its short lifespan. The HTTP response returns a 404 status, and the site is currently taken offline, which aligns with the “offline” status reported by monitoring services. The page title returned by the server, “Migrate.fun – Token Migration Platform,” suggests the domain was intended to masquerade as a token migration service, likely to lure cryptocurrency users.

The infrastructure details show the use of Netlify’s CDN and HSTS headers, a common pattern for abuse kits that rely on fast provisioning of phishing pages. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, and 13 of 93 VirusTotal scanners have flagged it, providing additional confirmation of malicious intent. Registration was performed through Name.com, a registrar frequently used for rapid domain acquisition. No further behavioral data, such as captured traffic or payloads, is publicly available, leaving the exact phishing workflow unverified.

Defenders should add the IP address 98.84.224.111 to network deny lists, enforce DNS sink‑hole rules for the domain, and monitor Netlify‑related traffic for similar short‑lived domains. Continuous observation of blocklist updates and VirusTotal re‑scans is recommended to capture any future re‑activation of the site. Organizations handling cryptocurrency assets should treat any unsolicited requests referencing “Migrate.fun” as suspicious and verify the source through official channels.