suitcat[.]gettoken[.]fun

The domain suitcat.gettoken.fun was registered on July 24 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is delegated to Cloudflare name servers alec.ns.cloudflare.com and erin.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, an address that is currently associated with a Cloudflare‑fronted hosting environment. The domain appears on a single public blocklist and has been explicitly flagged by the PhishDestroy sinkhole, confirming that it is being used for malicious activity.

VirusTotal records indicate that the domain was submitted to 91 scanning engines, none of which returned a detection at the time of analysis; this lack of detections should not be interpreted as an indication of safety, as the underlying content has not been publicly disclosed. No additional intelligence such as Safe Browsing status, Open Threat Exchange references, SSL certificate details, HTTP response codes, trust‑score metrics, page title, or evidence URLs is presently available, leaving the full scope of the phishing campaign uncertain. Given the recent creation date, the active blocklist entry, and the use of a reputable CDN provider to obscure the true hosting location, defenders should treat the domain as hostile.

Recommended actions include adding suitcat.gettoken.fun to network‑level deny lists, monitoring DNS queries for the associated IP 188.114.96.3, and correlating any inbound traffic with known phishing patterns. Continuous re‑evaluation is advised, as further artifacts such as page content or additional blocklist listings may emerge, providing clearer insight into the campaign’s tactics and targets.