io-sui--walet[.]pages[.]dev

The domain io-sui--walet.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and immediately resolved to the IP address 172.66.47.167, which belongs to AS13335 Cloudflare, Inc. in the United States. HTTP probing returns a 403 status code, and the site presents the page title "Suspected phishing site | Cloudflare," indicating that the content has been taken down or flagged by Cloudflare. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate certificate chain despite the malicious intent. Infrastructure analysis shows the domain is served behind Cloudflare’s edge network, leveraging HSTS and HTTP/3, and uses the nameservers lola.ns.cloudflare.com and todd.ns.cloudflare.com.

Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0 / 100, Google Safe Browsing flags the domain for social engineering, and it appears on one security blocklist maintained by PhishDestroy, which has already taken the site offline. VirusTotal reports that 11 of 93 security vendors have flagged the domain, reinforcing the malicious classification. The observed scam type is a crypto scam that impersonates the Sui brand, aligning with the brand target information.

While the page content beyond the title has not been publicly captured, the combination of a brand‑specific domain fragment, the Cloudflare‑based hosting, and the multiple threat intelligence indicators provides strong evidence of a high‑risk brand‑impersonation operation. Defenders should block the domain at DNS and proxy layers, monitor for any related sub‑domains or similar naming patterns, and ensure that endpoint protection solutions are updated to include the 11 vendor detections from VirusTotal. Continuous monitoring of Cloudflare‑originated IP ranges for new Sui‑related impersonation attempts is also recommended.