claims-plumenetwork[.]com

Analysis of claims-plumenetwork.com shows a newly registered (19 Nov 2025) domain that was quickly leveraged for a crypto‑related impersonation of the Sui brand. The domain resolves to 172.67.188.80, an address owned by Cloudflare (AS13335) and physically located in the United States. No TLS certificate is presented, indicating that the site was delivered over plain HTTP at the time of observation. The page title returned by the server is “Nur einen Moment…”, which offers no legitimate context and aligns with typical takeover tactics that redirect or stall victims. Gridinsoft assigns a trust score of 0 / 100, reflecting an extremely low reputation.

VirusTotal analysis recorded six detections out of ninety‑five scanners, confirming that multiple security engines recognize the domain as malicious. It has been listed on at least one public blocklist and is actively blocked by the PhishDestroy service, reinforcing the consensus that the site is unsafe. Nameserver records point to lars.ns.cloudflare.com and margaret.ns.cloudflare.com, both standard Cloudflare resolvers, suggesting the attacker exploited Cloudflare’s DNS service for rapid deployment. The registrar is Metaregistrar BV, a known European registrar that does not provide additional protective controls. Current operational status is offline, which limits immediate exposure but does not erase the risk to users who may have accessed the site before takedown.

Defenders should continue to block the domain at network perimeter devices, update URL filtering policies to include the host, and monitor for any reappearance of the domain or its IP in future traffic. Threat‑intel platforms should be consulted for any resurgence of the IP address, as Cloudflare hosts many unrelated services.