sui-pay-hackathon[.]vercel[.]app

This domain, sui-pay-hackathon.vercel.app, is flagged as a high-risk brand impersonation threat targeting the Sui blockchain ecosystem. Analysis indicates the site mimics a legitimate payment gateway under the title 'Sui Protected Payment Gateway,' likely designed to harvest cryptocurrency wallet credentials or facilitate unauthorized transactions. No explicit drainer kit signatures were identified, but the domain’s structure and branding align with known phishing tactics used in crypto-related fraud campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 64.29.17.3, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. It was registered on February 21, 2026, through Tucows Domains Inc. and remains active despite being flagged by Google Safe Browsing as phishing. VirusTotal reports 10 out of 95 security vendors detecting malicious activity, while PhishDestroy has blocked the domain, contributing to its presence on one security blocklist. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend false legitimacy to phishing sites. As of the latest assessment, the domain remains active, posing an ongoing risk to users who may mistake it for an official Sui service. Recommended response actions include immediate blacklisting of the domain and IP across all security gateways, dissemination of indicators of compromise (IOCs) to relevant threat intelligence platforms, and user education to recognize brand impersonation tactics. Despite existing detections, the domain’s continued operation underscores the need for heightened vigilance, particularly among cryptocurrency users interacting with payment gateways or wallet services.