suiflow[.]digital

PhishDestroy has identified suiflow.digital as a live credential harvesting domain actively impersonating a legitimate login portal. Current status is under investigation, but the threat remains active and poses significant risk to users tricked into entering sensitive login details. This domain is not yet flagged by major security vendors, emphasizing the need for proactive monitoring.

This domain was flagged by zero of 95 VirusTotal vendors, indicating it has evaded detection despite hosting malicious content. It resolves to IP address 172.67.180.94 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain was created on December 30, 2025, and leverages a Let’s Encrypt SSL certificate to appear legitimate. No blocklist entries or trust score metrics are publicly available at this time, further complicating detection efforts.

Given the active status and lack of vendor detection, organizations and users should consider blocking this domain at the network and endpoint levels. Users are advised to verify URLs before entering credentials and report any suspicious activity immediately. Security teams should monitor for related infrastructure and update threat intelligence feeds accordingly. Immediate action is recommended to mitigate potential credential theft.