browse-sui-wallet[.]pages[.]dev

browse-sui-wallet.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.45.26, located in the United States under ASN 13335 (Cloudflare, Inc.). The domain is served with a Google Trust Services / WE1 SSL certificate, enforces HSTS, and supports HTTP/3. An HTTP request returns status code 403 and the page title reported by scanners is “Suspected phishing site | Cloudflare”. The site is classified as a crypto‑related brand impersonation campaign targeting the Sui ecosystem. Google Safe Browsing flags the domain for social engineering, and VirusTotal records 11 detections out of 93 scanning engines.

The domain appears on a single public blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious intent. Nameservers listed are rob.ns.cloudflare.com and emerie.ns.cloudflare.com. The current status is offline, suggesting the operators have taken the site down. Evidence confirms that the infrastructure is fully hosted on Cloudflare, leveraging its global network to obscure the true origin of the payload.

The low trust score, multiple vendor detections, and explicit branding as a Sui impersonation reinforce the assessment of a high‑risk phishing operation. Uncertainty remains regarding the specific payload delivered to victims, as no page content beyond the title has been captured. Defenders should continue to block the domain at DNS and network layers, monitor for any resurgence of the host or similar subdomains, and update detection signatures to include the observed IP address, SSL certificate fingerprint, and the “Suspected phishing site | Cloudflare” title pattern. Ongoing vigilance is advised given the recent creation date and the high‑risk classification.