eduvantageaimigrate[.]xyz

Analysis of the domain eduvantageaimigrate.xyz indicates it is associated with an investment scam operation, as classified by security vendors. The domain was registered on March 21, 2026, through OwnRegistrar, Inc., and currently resolves to the IP address 188.114.97.3, hosted under Cloudflare, Inc. in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (garrett.ns.cloudflare.com and grannbo.ns.cloudflare.com) and a Let's Encrypt SSL certificate, which are common among both legitimate and malicious sites. The domain is flagged on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting confirmed malicious activity.

The page title, 'Trade EAI,' aligns with the reported scam type of an investment scheme, though the exact content and mechanics of the scam remain unconfirmed due to the domain being offline at the time of analysis. Four out of 95 security vendors on VirusTotal have detected the domain as malicious, reinforcing its elevated risk classification. Technologies detected on the domain include Node.js, Vue.js, Nuxt.js, and Cloudflare Browser Insights, which are not inherently malicious but are frequently leveraged in phishing and scam infrastructure for dynamic content delivery and evasion.

Defenders should treat this domain as compromised and implement blocking measures at the DNS or network level. Given its presence on multiple blocklists and association with known scam indicators, organizations are advised to monitor for any attempts to access or interact with eduvantageaimigrate.xyz. Further investigation into related domains or IPs may be warranted to identify broader campaign infrastructure.