migratefuns[.]live

Analysis of migratefuns.live indicates a high-risk phishing domain targeting cloud service credentials, active as of July 27, 2026. The domain was registered on April 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It currently resolves to IP address 188.114.96.3, which is part of Cloudflare's infrastructure, a common tactic used to obscure hosting origins and evade IP-based blocking. The domain's nameservers (amanda.ns.cloudflare.com and damian.ns.cloudflare.com) further confirm Cloudflare's involvement in its DNS resolution, a pattern observed in many phishing campaigns leveraging Cloudflare's proxy services for anonymity. Detection data from security vendors is limited but indicative of malicious activity.

As of the latest assessment, four out of ninety-one security vendors on VirusTotal have flagged migratefuns.live, suggesting early but growing recognition of its fraudulent nature. The domain appears on at least one security blocklist, specifically PhishDestroy, which has classified it as a phishing threat. No additional blocklist or threat intelligence platform mentions were provided, limiting broader context on its reputation across other security communities. The domain remains active, with no evidence of takedown or mitigation efforts. No HTTP status codes, SSL certificate details, or page content analysis were provided in the available intelligence, leaving the exact nature of the phishing kit or targeted brand uncertain.

However, the use of Cloudflare nameservers and proxy services is consistent with infrastructure used to host credential-harvesting pages, particularly those mimicking cloud storage or collaboration platforms. Defenders should treat migratefuns.live as an active threat. Network-level blocking of the domain and its resolving IP (188.114.96.3) is recommended, alongside monitoring for related DNS queries or connections to the same Cloudflare nameservers.