suliend[.]pw

Analysis of the domain suliend.pw indicates that it was registered on February 27, 2026 through NameSilo, LLC and is currently hosted on Cloudflare infrastructure (AS13335). The domain resolves to IP address 172.67.209.94, which is geolocated to the United States and serviced by the Cloudflare nameservers isla.ns.cloudflare.com and razvan.ns.cloudflare.com. No TLS certificate was observed, meaning the site served HTTP without encryption. The page title returned by the HTTP response is "Phase 2 Distribution," which does not directly reference the targeted brand but aligns with the reported scam type of brand impersonation.

The site is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that five of ninety‑four security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. The intelligence identifies the impersonated brand as Solend, confirming the intent to deceive users of that service.

As of the report date, July 22, 2026, the domain has been taken offline, but the historical footprint suggests that threat actors may reactivate the same infrastructure or register similar domains. Defenders should continue to block the domain and its IP at perimeter defenses, monitor for re‑use of the associated Cloudflare IP range, and update detection rules to include the page title "Phase 2 Distribution" as an indicator of compromise. Further investigation is needed to determine whether additional payloads or command‑and‑control endpoints were associated with the site before takedown, and whether the same registrar or nameserver pattern recurs in other observed campaigns.