cabalcalvinmigrate[.]xyz

cabalcalvinmigrate.xyz was registered on March 15 2026 through OwnRegistrar, Inc. and resolves to the Cloudflare IP address 172.67.210.77, which is associated with Cloudflare, Inc. in Canada. The domain is hosted behind Cloudflare, as indicated by the nameservers dana.ns.cloudflare.com and ethan.ns.cloudflare.com and the presence of Cloudflare Browser Insights and HTTP/3 support. No TLS certificate is presented, meaning the site served only HTTP. Front‑end technologies detected include Node.js, Vue.js and the Nuxt.js framework, suggesting a modern JavaScript stack. The page title returned by the server is “CALVIN”, but no additional content has been captured.

VirusTotal analysis shows that a single security vendor out of ninety‑four flagged the domain, and the domain currently appears on three independent blocklists. It has also been listed by the PhishDestroy, MetaMask and SEAL blocklist services. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent. The domain is presently taken offline, which limits immediate interaction but does not remove the underlying infrastructure.

Evidence confirms the domain’s use in a generic phishing campaign, yet the specific victim lure or credential‑stealing page has not been observed. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation of the IP address, and add the host to internal threat‑intel feeds. Given the low trust score and the presence on multiple blocklists, any future resolution of the domain should be treated as malicious. Ongoing observation of the associated Cloudflare IP range is recommended to detect potential repurposing for other campaigns.