app-migrate-fun[.]pages[.]dev

PhishDestroy identifies app-migrate-fun.pages.dev as a live phishing domain masquerading as a file-migration utility to deceive users into downloading malicious payloads. The site is classified under the ‘generic_phishing’ threat type and currently carries an active status with a risk level still under investigation; however, preliminary indicators suggest elevated danger for end-users seeking legitimate cloud-migration services. This domain resolves to IP address 188.114.96.3 via Cloudflare’s proxy network and has been provisioned with a Google Trust Services SSL certificate, lending it a superficial appearance of legitimacy. VirusTotal scans return a clean 11 out of 95 detection rate, indicating no immediate anti-virus condemnation despite behavioral red flags. The domain is registered through Cloudflare, Inc., leveraging their infrastructure to obscure origin and complicate takedown efforts. There are no current listings on major blocklists such as Google Safe Browsing or PhishTank, and trust scoring engines have not yet flagged the domain. Consequently, the lack of preemptive blocking amplifies the risk of successful compromise. To mitigate exposure to this threat, users must refrain from clicking or interacting with any links or download buttons on app-migrate-fun.pages.dev. Organizations should block the domain at DNS and firewall levels using the exact string app-migrate-fun.pages.dev. If accidental access occurs, isolate affected systems, scan with updated endpoint protection, and inspect outbound traffic for connections to 188.114.96.3. Report the domain to Google Safe Browsing via their submission portal and forward artifacts to CERT teams for accelerated analysis. Cloudflare abuse channels should also be engaged for infrastructure-level intervention.