eligible-suilend[.]my

The domain eligible-suilend.my was observed to host a crypto‑related brand‑impersonation campaign targeting the Sui ecosystem. Registration data indicates the domain was created on 13 March 2026 through NameSilo, LLC, and it resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). No TLS certificate was presented, and the HTTP response served a generic page with the title “Just a moment…”, suggesting the site is currently serving a Cloudflare challenge page rather than malicious content. Cloudflare Browser Insights, Cloudflare, and HTTP/3 were detected, confirming the use of Cloudflare’s edge network.

Threat intelligence shows the domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—and is flagged by four of ninety‑four VirusTotal scanners. The elevated risk rating reflects the combination of brand impersonation, crypto‑scam classification, and the presence on multiple security feeds. Because the site is listed as offline at the time of analysis, no active payload or credential‑harvesting page has been captured; the exact malicious behavior remains unverified beyond the brand‑spoofing intent. Defenders should add the hostname and its resolving IP to local deny lists, enforce DNS‑level blocking for the listed blocklists, and monitor Cloudflare‑originating traffic for other domains that share the same nameservers (isla.ns.cloudflare.com, razvan.ns.cloudflare.com).

Continuous re‑query of the domain’s status is advised, as the offline state may be temporary and the actors could re‑activate the site to deliver crypto‑drainer content. Organizations that interact with the Sui blockchain should educate users about unsolicited requests referencing Sui and verify URLs against official sources. The combination of recent registration, Cloudflare infrastructure, and multi‑vendor detection underscores the need for proactive defensive controls.