migrate-radrlabs[.]world

Analysis of migrate-radrlabs.world indicates an active phishing domain registered on February 21, 2026, through OwnRegistrar, Inc. The domain resolves to IP address 188.114.96.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (lady.ns.cloudflare.com and langston.ns.cloudflare.com), alongside detected technologies including HSTS, Cloudflare Browser Insights, and HTTP/3, suggesting an attempt to present a legitimate appearance while leveraging Cloudflare’s protective services. The domain currently returns an HTTP 403 status with the page title 'Nur einen Moment…', a phrase commonly associated with Cloudflare’s interstitial pages or rate-limiting mechanisms. This may indicate either a temporary access restriction or a deliberate evasion tactic to hinder automated analysis.

As of July 25, 2026, the domain remains active and is flagged by one security blocklist, while three of ninety-three security vendors on VirusTotal have detected it as malicious. AlienVault OTX lists it in a single threat intelligence pulse, and Gridinsoft assigns a trust score of 0 out of 100, further corroborating its high-risk classification. The SSL certificate is issued by Google Trust Services (WE1), a common but not inherently suspicious provider.

No specific brand or scam type has been confirmed in available data, and the exact phishing target remains unanalyzed. Defenders should treat this domain as a confirmed phishing threat, particularly given its recent registration, low detection but non-zero vendor flags, and use of Cloudflare infrastructure. Network-level blocking at the IP (188.114.96.3) or domain level is recommended, alongside monitoring for related domains registered through OwnRegistrar, Inc. Further investigation into the 'Nur einen Moment…' page behavior and any subsequent redirects is advised to determine the full scope of the campaign.