migrateon[.]fun

Analysis conducted on July 24 2026 indicates that migrateon.fun is associated with a generic phishing operation. The domain was registered on March 11 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served by Cloudflare’s DNS infrastructure, using the authoritative nameservers amos.ns.cloudflare.com and maya.ns.cloudflare.com. DNS resolution points to the IP address 104.21.9.224, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents the page title “Migrate.fun – Token Migration Platform,” suggesting an attempt to lure victims into token‑migration activities. The site currently returns an HTTP 404 status code, and the overall status is listed as taken offline.

Nevertheless, the domain appears on three external blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the phishing classification. A Let's Encrypt certificate (E8) is in place, which is common for both legitimate and malicious sites. VirusTotal analysis shows that one of ninety‑four security vendors flagged the domain, providing an additional data point of malicious intent. No other public scanning services are referenced, and no Safe Browsing or OTX entries are available in the supplied intelligence. Infrastructure analysis reveals no anomalous hosting; the domain relies entirely on Cloudflare’s edge network and HTTP/3 support, which does not itself indicate compromise.

The primary evidence for phishing risk stems from the blocklist listings, the token‑migration title, and the single vendor detection. Because the site is presently offline, active payload delivery cannot be confirmed, but the existing indicators merit precautionary action. Defenders should add migrateon.fun to domain blocklists, monitor traffic to the associated Cloudflare IP address for any residual activity, and consider extending filtering rules to cover similar token‑migration keywords.