suii-walet-io[.]pages[.]dev

Analysis of suii-walet-io.pages.dev indicates that the domain was registered on November 07, 2025 through Cloudflare, Inc. and is presently taken offline. The authoritative nameservers aldo.ns.cloudflare.com and ophelia.ns.cloudflare.com resolve the domain to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 label, and the HTTP response returned a 403 status code, indicating that direct content retrieval was blocked at the time of testing. Security instrumentation reports that 11 of 95 VirusTotal scanners flagged the domain, and it appears on a single external blocklist managed by PhishDestroy.

The page title returned by the server is “Suspected phishing site | Cloudflare”, and the domain is classified as a brand‑impersonation campaign targeting the Sui brand. Additional technical fingerprints include enforcement of HSTS, use of Cloudflare’s edge services, and support for HTTP/3. A Gridinsoft trust score of 0 out of 100 further underscores the malicious reputation.

While the domain is no longer serving active content, its recent creation date, the presence of a valid SSL certificate, and the low trust score suggest it was intended for a short‑lived phishing operation. Defenders should continue to block the IP address 188.114.97.3 and the domain name at perimeter defenses, monitor for any resurgence or re‑registration of similar subdomains under the Cloudflare namespace, and incorporate the observed indicators—such as the specific nameserver pair, certificate issuer, and VirusTotal detection count—into threat‑intel feeds. Ongoing observation of Cloudflare‑hosted domains that reference the Sui brand is recommended to detect future impersonation attempts.