en-sooiwallewts[.]pages[.]dev

Analysis of the domain en-sooiwallewts.pages.dev indicates a high-risk phishing campaign targeting users through brand impersonation, specifically mimicking the SuiWallet digital asset management service as evidenced by the page title 'SuiWallet | Your Gateway to Digital Asset Management.' The domain was registered on November 10, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.206, hosted on Cloudflare's infrastructure (AS13335). Google Safe Browsing has flagged this domain for social engineering, a classification consistent with wallet or seed phishing attempts. The domain's SSL certificate is issued by Google Trust Services (WE1), and it employs Cloudflare nameservers (charles.ns.cloudflare.com and maeve.ns.cloudflare.com), alongside security technologies such as HSTS and HTTP/3. Detection data from security vendors reveals that 12 out of 95 engines on VirusTotal have flagged this domain as malicious.

Additionally, the domain appears on at least one security blocklist, and PhishDestroy has actively blocked it. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious classification. As of July 24, 2026, the domain returns an HTTP 403 status, indicating it has been taken offline, though defenders should remain vigilant for potential reactivation or migration to alternative infrastructure. The available evidence does not provide conclusive details on the specific phishing kit or the exact tactics employed beyond the impersonation of SuiWallet.

However, the combination of brand impersonation, seed phishing classification, and detection by multiple security vendors strongly suggests an intent to harvest sensitive information such as wallet seeds or private keys. Defenders are advised to monitor for related domains registered through Cloudflare or resolving to similar IP ranges, particularly those leveraging the .pages.dev subdomain structure.