migrates-fun[.]pages[.]dev

PhishDestroy identifies an active crypto-drainer phishing campaign hosted at migrates-fun.pages.dev. This fraudulent page is designed to trick cryptocurrency users into connecting their wallets and approving malicious token transfers that drain funds directly. The site mimics legitimate crypto interfaces and prompts victims to sign wallet transactions under false pretenses, such as claiming to offer token migration or staking rewards. Users who interact with this page risk unauthorized asset transfers to attacker-controlled wallets. This domain was flagged through PhishDestroy’s automated pipeline on seed bd599e. It resolves to IP 172.66.44.204 and uses a Google Trust Services SSL certificate. Importantly, VirusTotal currently reports 1 out of 95 detection engines flagging this domain, indicating it remains under the radar of most security tools. The domain is registered via Cloudflare, Inc., leveraging the company’s Pages.dev platform—a common choice among threat actors to host deceptive content under a reputable domain. If you visited migrates-fun.pages.dev, disconnect your wallet immediately using your wallet’s emergency disconnect feature. Do not approve any pending transactions or sign messages of unknown origin. Scan your device with updated antivirus software and consider revoking any suspicious token approvals using tools like Etherscan’s Token Approval Checker. Report the domain to PhishDestroy and your wallet provider for further investigation. Always verify crypto-related links through trusted platforms before interacting.