suliend-check[.]buzz

Analysis of the domain suliend-check.buzz shows a clear pattern of brand impersonation targeting Discord users with an alleged “Phase 2 Airdrop”. The domain was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.67.185.136 located in the United States. Both authoritative nameservers, magdalena.ns.cloudflare.com and mark.ns.cloudflare.com, resolve to the same Cloudflare edge, indicating the attacker leveraged Cloudflare’s free tier to hide origin infrastructure. No TLS certificate was presented, meaning the site operated over plain HTTP, a common trait for low‑effort phishing kits.

The page title observed during the brief crawl was “Phase 2 Airdrop”, and the kit has been identified as an “Airdrop Scam”, consistent with the Discord brand target listed in the intelligence. Independent blocklist operators PhishDestroy and ScamSniffer have already added the domain to their deny lists, and the domain appears on two additional security blocklists. VirusTotal analysis recorded four detections out of ninety‑three scanners, reinforcing the malicious classification.

The site is currently offline, limiting further content inspection, and no additional evidence such as payload hashes or screenshot captures is available. Defenders should immediately block the domain at network perimeter and DNS filtering layers, add the associated IP address to hostile‑IP lists, and monitor for similarly named subdomains that reference Discord or airdrop terminology. Continuous observation of Cloudflare‑hosted infrastructure for new registrations matching the observed pattern is advised, as the attacker may reuse the same hosting provider for future campaigns.