login[.]kgbpkh6syhgxptsgwkqc93ushhphua422xb7ma[.]2bd[.]net

This domain, login.kgbpkh6syhgxptsgwkqc93ushhphua422xb7ma.2bd.net, presents an elevated risk of brand impersonation, specifically targeting the Sui brand. The threat involves the creation of a deceptive login page designed to trick users into entering their credentials, which can then be misused for unauthorized access or financial gain.

Analysis indicates that the domain is flagged by 15 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus regarding its malicious nature. Registered through Netdorm, Inc. dba DNSExit.com, the domain resolves to the IP address 64.118.134.116. It was created on December 26, 2025, which is a relatively recent date, often associated with newly registered domains used for malicious purposes. The domain appears on one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trustworthiness. The presence of Apache Traffic Server and HSTS (HTTP Strict Transport Security) suggests an attempt to appear legitimate and secure, which can further deceive unsuspecting users.

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the URL of any Sui-related login pages before entering their credentials. Organizations should implement DNS blacklisting to block access to the domain and educate their users about the importance of recognizing and avoiding phishing attempts. Additionally, security teams should monitor for any similar domains and ensure that all network traffic is filtered through reputable security solutions to prevent access to malicious sites.