eligible-suiiend[.]lat

eligible-suiiend.lat was registered through NameSilo, LLC and first observed on February 21, 2026. The domain resolves to 104.21.36.212, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Its authoritative nameservers are isla.ns.cloudflare.com and razvan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate is presented, meaning connections are served over plain HTTP. The site’s HTML title, as captured by security scanners, reads “Phase 2 Distribution,” and the domain is listed as impersonating the Sui brand, consistent with its classification as a crypto‑scam operation.

The domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intel feeds have flagged it. VirusTotal analysis shows the URL was submitted to 93 scanning engines, none of which raised a detection at the time of the scan; the absence of a positive result does not constitute evidence of legitimacy. The domain’s current status is offline, suggesting the operator has removed the site after detection. While the available evidence points to a brand‑impersonation scheme targeting users of the Sui cryptocurrency platform, the exact phishing payload, credential‑ harvesting mechanisms, or malicious scripts remain unverified because the page content has not been captured.

Defenders should continue to block the domain at network perimeters, update URL filtering rules, and monitor for any re‑registration or resurrection of the same host name. Additional investigation of the associated IP address for other malicious activity is recommended, as Cloudflare‑hosted IPs can be shared among many unrelated services. Organizations that interact with Sui‑related wallets should alert users to the possibility of fraudulent URLs bearing similar patterns, even when no SSL certificate is present.