migrationdione[.]com

This domain, migrationdione.com, is flagged as an active high-risk brand impersonation threat targeting Coinbase users. Registered on December 13, 2024, through Tucows Domains Inc., the site remains operational as of July 12, 2026, with a page title of 'Dione Migration.' Infrastructure analysis reveals the domain resolves to IP address 216.24.57.7 and employs Cloudflare for hosting, alongside jQuery and Google Hosted Libraries for frontend functionality. The use of HTTP/3 and a Google Trust Services SSL certificate may lend an appearance of legitimacy, though these elements are frequently exploited in phishing operations to evade detection. Threat intelligence indicates widespread recognition of this domain as malicious. It appears in 22 AlienVault OTX pulses and is listed on five security blocklists, including Polkadot, Codeesura, and PhishDestroy. While 4 out of 95 security vendors on VirusTotal flag the domain, the absence of broader detection does not diminish the risk, as phishing campaigns often employ rapid domain rotation to avoid automated scrutiny. The domain's trust score of 0/100 further corroborates its classification as a high-risk entity. The exact mechanics of the phishing operation remain uncertain due to the lack of direct page analysis. However, the combination of a Coinbase impersonation claim, the 'Dione Migration' page title, and the domain's technical infrastructure suggests an attempt to harvest credentials or financial information. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Coinbase-related services are accessed. Monitoring for related domains registered through Tucows Domains Inc. or resolving to the same IP may uncover additional components of this campaign. Given the domain's persistence since late 2024, it is likely part of a broader, ongoing phishing effort rather than an isolated incident.