migrate-centrifuge[.]pages[.]dev

This domain, migrate-centrifuge.pages.dev, is flagged for targeted crypto credential theft through brand impersonation. Analysis indicates the site mimics the Centrifuge App, a legitimate decentralized finance platform, likely to harvest wallet credentials or private keys. No explicit drainer kit signatures were identified, but the page title and infrastructure align with credential harvesting tactics observed in prior crypto-phishing campaigns. Infrastructure analysis reveals the domain resolves to IP 188.114.96.3 and was registered through Cloudflare, Inc. on June 09, 2026. The SSL certificate is issued by Google Trust Services, and the site employs HSTS and HTTP/3 protocols. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists and is currently offline, though no Google Safe Browsing (GSB) detections were recorded. Gridinsoft assigns a trust score of 0/100, further corroborating malicious intent. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk persists as threat actors may re-deploy the phishing kit under a new domain or subdomain. Users who interacted with the site should revoke active sessions, rotate credentials, and monitor wallet transactions for unauthorized activity. Network-level blocking of the IP 188.114.96.3 and associated domains is recommended for proactive defense.