layerai-migration[.]top

layerai-migration.top entered the PhishDestroy evidence set on Jun 23, 2026. The hostname uses “migration,” a pattern consistent with a wallet-migration lure; no target brand is confirmed from stored content. The stored content classification is generic phishing. The assembled evidence scores 100/100 (critical).

Five independent sources are positive: VirusTotal, MetaMask, ScamSniffer, SEAL, and Google Safe Browsing. VirusTotal recorded 11 detections among 91 engines: ADMINUSLabs, BitDefender, Chong Lua Dao, CRDF, CyRadar, Fortinet, G-Data, Google Safebrowsing, Kaspersky, Lionic, Sophos on Jun 23, 2026 at 06:15 UTC. MetaMask, ScamSniffer, and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing flagged the domain: Social Engineering on Jun 23, 2026 at 04:40 UTC. The evidence is not unanimous. URLQuery recorded no positive detection. URLScan completed without a malicious verdict (score 0) on Jun 23, 2026 at 08:10 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:18 UTC; content was unavailable. Registration records for the domain list NameSilo, LLC as the registrar and Apr 15, 2026 as the creation date. At collection time, the hostname resolved to 74.50.69.84 on AS19318 (IS-AS-1 - Interserver, Inc, US). The associated network metadata labels the endpoint as AS19318 Interserver, Inc in New York City, US. The stored server header is LiteSpeed. Captured page title: “Default page”. DOM analysis completed on Jun 23, 2026 at 06:20 UTC; stored DOM score 100/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:52 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Let's Encrypt / YR2 as the certificate issuer with validity through Sep 13, 2026; checked Jun 23, 2026 at 07:00 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as generic phishing.