Is migrate-kinggrippy.pages.dev a scam? TrustSniffer's high-risk assessment: 16/100

Overview

GRIPPY is a single-page website at a hostname on a shared developer-hosting subdomain. The hostname begins with "migrate-kinggrippy". Its homepage carries a title of "grippy" and several thousand characters of rendered text, and it makes heavy use of third-party network calls. Its business purpose could not be independently established from the available evidence, so what it offers a visitor remains unconfirmed.

Scam/Impersonation Risk

Contradictory signals are present, and they drive the cautionary posture of this report. Multiple independent threat-intelligence engines currently flag the site as malicious, and an external blacklist listing is confirmed. This is a confirmed blacklisting, not a soft reputational signal. No conflicting legal entities were observed, so there is no identity contradiction. No brand impersonation or wallet-drainer behavior was confirmed. The homepage showed no wallet-connection prompts, no clipboard manipulation, no hidden forms and no cloaking during three successful behavioral runs. Those clean results do not offset the threat listings. The site's behavior adds to the concern. About nine in ten of its requests went to external destinations, including dozens of external data calls. Several outbound POST submissions went to destinations outside the set of commonly recognized services. The page also changed substantially after interaction. The "migrate" wording in the hostname is consistent with a token- or account-migration lure, but the available page evidence does not confirm that. The domain is also very new, which is a typical profile for disposable infrastructure. Evidence:

• Homepage and network behavior: 52 external XHR/fetch calls and 9 external POSTs were observed, 3 of the POSTs to non-whitelisted destinations. Roughly 88% of requests were external at peak.
• Reputation: 3 threat-intelligence engines flagged the domain as malicious, and an external blacklist listing is confirmed.
• Domain provenance: first observed in 2026 (~32 days old, ~0.09 years). The web archive holds 2 snapshots (2026-09-19 to 2026-09-22), spanning under one year.
• Homepage interaction: DOM mutations reached 246 after interaction, with no cloaking and no wallet-provider activity.

Regulatory Verification Notes

The homepage that was captured gives no identifiable operator, legal entity, license or registration number, and no legal or terms pages were evidenced. Real-world identity has not been independently verified, and the on-site content provides no basis for connecting the site to an accountable business. No regulatory standing can be attributed to the site, and no third-party broker or regulator profile matched it. The absence of disclosures is a verification gap. It matters here because it sits alongside the confirmed threat listings, so there is no accountable party to hold responsible for any transaction. Evidence:

• Homepage: no company name, licensing statement or registration number was visible.
• Third-party broker reputation: no match was found, so there is no external regulatory standing to cite.
• Hosting: served from AS13335 (Cloudflare, US, ARIN registry).
• Transport encryption: a TLS certificate issued by WE1 (DV, domain-validated only) is valid to 2027-01-09, with about 79 days remaining. DV validates domain control only and says nothing about the operator.

What to Verify Next

Do not rely on the site itself for any of this. First, confirm through an independent route whether the project or brand behind "GRIPPY" exists, using official channels that were announced before this site appeared. Second, check any claimed token migration or account action against those official announcements, not against links found on this site. Third, check whether the threat-intelligence detections have been cleared, and treat any later removal as meaningful only if the domain's behavior has also changed. Fourth, confirm official support and contact channels through an independent, offline route before relying on any listed on the site. Evidence:

• Hostname: the "migrate" naming and the recently created subdomain are the basis for the official-channel check.
• Reputation: the current threat detections are the baseline against which any later clearance should be compared.
• Domain history: only 2 archive snapshots over a few days, so there is no earlier legitimate track record to lean on.

Summary Verdict

The site carries an elevated risk posture. Confirmed threat listings, a very recent domain and aggressive outbound data activity outweigh the technically valid encryption and the clean sandbox behavior. Its real-world operator is unidentified, and the available evidence does not support treating it as legitimate.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF. All four observed addresses, both IPv4 and IPv6, are edge servers, and no origin server address was observable. This is a mitigating factor only. It gives no assurance about who operates the site, and edge-only visibility prevents independent hosting verification and can mask rapid content changes. Protective infrastructure cannot offset the reputational risk here.

Closing Assessment

At most, the site should be viewed read-only. No login, credential entry, wallet connection, payment or other financial interaction should take place on it, and nothing should be downloaded from it. Anyone who has already interacted with it should treat any credentials or approvals they supplied as potentially exposed, rotate them, and revoke any wallet permissions granted.