eligible-suiiend[.]top

Analysis of the domain eligible-suiiend.top indicates it was actively involved in a crypto scam impersonating the Sui blockchain platform. The domain, registered on February 27, 2026, through NameSilo, LLC, was hosted behind Cloudflare infrastructure, resolving to the IP address 104.21.32.185 (AS13335, United States). Nameservers isla.ns.cloudflare.com and razvan.ns.cloudflare.com were configured, a common pattern for domains seeking to obscure hosting origins. No SSL certificate was detected, increasing the likelihood of insecure connections and potential interception of user data.

The domain was flagged by three security blocklists and detected by one of 93 security vendors on VirusTotal, suggesting moderate but not widespread detection at the time of analysis. Specific blocking by PhishDestroy, MetaMask, and SEAL further confirms its classification as a crypto-related threat. The page title 'Just a moment...' aligns with Cloudflare's interstitial challenge page, indicating the domain may have been configured to filter or redirect visitors dynamically rather than serving static content. As of July 22, 2026, eligible-suiiend.top is offline, though its infrastructure remains registered.

Defenders should treat this domain as part of a broader campaign targeting cryptocurrency users, particularly those interacting with the Sui ecosystem. Network-level blocking of the domain and its resolved IP is recommended, along with monitoring for related domains using the same nameservers or registrar. The absence of an SSL certificate and the use of Cloudflare nameservers may serve as additional indicators for retrospective hunting in logs. Further investigation into the registration details and hosting patterns could reveal links to other fraudulent domains.