imp-suiwallet-io[.]pages[.]dev

This domain, imp-suiwallet-io.pages.dev, was registered through Cloudflare on September 2, 2020 and currently resolves to the Cloudflare edge address 172.66.47.101 located in the United States under ASN 13335. The authoritative name servers listed are adi.ns.cloudflare.com, anuj.ns.cloudflare.com, julissa.ns.cloudflare.com, and karl.ns.c, confirming the use of Cloudflare’s DNS infrastructure. The site presents a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that access has been deliberately blocked. The TLS certificate is issued by Google Trust Services and carries the WE1 identifier, showing a valid HTTPS endpoint despite the block.

Security telemetry records a Google Safe Browsing classification for social engineering, placement on one public blocklist, and a detection by PhishDestroy. VirusTotal analysis shows twelve of ninety‑five scanners flag the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. Detected technologies include HTTP/3, HSTS, and Cloudflare’s performance and security services. The domain is actively impersonating the Sui brand, as indicated by the “Brand target: Sui” field, and is categorized as a crypto‑related scam.

While the site is currently offline, the combination of a valid SSL certificate, Cloudflare‑hosted infrastructure, and multiple independent detections suggests a deliberate attempt to lure victims into a fraudulent Sui‑related transaction. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the listed name servers, and add the domain to internal threat intel feeds. Ongoing observation of any future re‑hosting attempts is recommended, as the underlying infrastructure could be reused with a different front‑end.