explore-sui-wallet-in[.]pages[.]dev

explore-sui-wallet-in.pages.dev was registered on February 21 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 172.66.44.206 located in the United States under ASN 13335. The site presents a TLS certificate issued by Google Trust Services (WE1), and HTTP responses include HSTS and HTTP/3 support, indicating a modern Cloudflare‑managed front end. An HTTP GET returns a 403 status code, and the page title retrieved from the live snapshot reads “SuiWallet: Beginner's Guide to Managing Sui Blockchain Assets”, directly referencing the Sui brand. The threat profile in the intelligence set categorises the page as a wallet/seed phishing operation that impersonates the Sui brand.

Google Safe Browsing flags the domain for social engineering, and the Gridinsoft trust score is 0 out of 100, reflecting a lack of credibility. VirusTotal analysis shows that 11 of 93 scanning engines have flagged the domain, reinforcing the malicious assessment. The domain appears on a single security blocklist and is currently listed as blocked by PhishDestroy. The nameservers sue.ns.cloudflare.com and julio.ns.cloudflare.com confirm the use of Cloudflare DNS.

The site has been taken offline as of the report date, July 23 2026, but the infrastructure details remain valuable for detection. Defenders should continue to block the domain and associated IP address, monitor for any re‑registration attempts, and add the domain to internal allow‑list exclusions for Sui‑related traffic. Additional investigations should verify whether any credential harvesting endpoints were ever reachable before the takedown, and security teams should update phishing detection rules to include the observed page title and the combination of Cloudflare‑served TLS with a 403 response on a brand‑impersonating URL.