nillionmigrate[.]info

Analysis dated July 25 2026 flags nillionmigrate.info as an offline generic phishing site. The domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the A record pointing to 188.114.96.3, an IP located in the United States. The authoritative name servers are ali.ns.cloudflare.com and clark.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate is presented, so HTTPS connections would be rejected or fall back to HTTP.

The page title observed before takedown was "Nillion Bridge – NIL Migration," but the actual page content has not been captured publicly. VirusTotal scanned the domain and three of ninety‑three security vendors flagged it, confirming malicious behavior. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy mitigation platform. Because the site is currently offline, active probing yields no HTTP response, but the infrastructure components remain registered and could be re‑used.

Defenders should continue to block the domain at perimeter filters, add the associated IP address to deny lists, and monitor the Cloudflare name servers for any re‑registration. Additional observation of DNS changes or new TLS certificates would indicate a potential resurrection. Investigation of related domains registered by the same registrar in the same period may reveal a broader campaign. Until the domain is confirmed removed from all threat feeds, maintain the elevated risk rating and enforce user education on unsolicited communications that reference "Nillion Bridge" or "NIL Migration".