theportalsui-io2026[.]com

The domain theportalsui-io2026.com is currently active and classified as a brand impersonation campaign targeting the Sui brand. The site presents the page title "Just a moment..." and returns an HTTP 403 status code when accessed. DNS resolution points to IP address 188.114.96.3, which is associated with CloudFlare, Inc. in Canada. The TLS certificate is issued by Let’s Encrypt (E8), indicating a standard free certificate without additional validation. Registration data shows the domain was created on May 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Reputation metrics are poor: Gridinsoft assigns a trust score of 0/100, and VirusTotal records 2 of 91 security vendors flagging the domain. The domain is listed on one public blocklist and is actively blocked by PhishDestroy. While the page title and HTTP response are known, the full content and any credential‑harvesting mechanisms have not been publicly disclosed, leaving the exact malicious payload uncertain. Defenders should immediately block the domain at the DNS and proxy layers, monitor for any traffic to 188.114.96.3, and add the domain to internal threat intelligence feeds. Continuous re‑evaluation is advised in case additional indicators emerge.