suii-wallet-extension[.]typedream[.]app

This domain, suii-wallet-extension.typedream.app, was observed hosting a fraudulent page that claims to be a “Sui Wallet Extension – Safe, Seamless SUI Transactions.” The page title directly references the Sui brand, indicating a classic brand‑impersonation tactic. The site is registered through Cloudflare, Inc., and its TLS certificate is issued by Google Trust Services under the WE1 root, suggesting the use of Cloudflare’s SSL termination service. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The HTTP response returned a 403 status code, which may be a result of the site being taken offline after detection. VirusTotal analysis shows that 11 of 95 security scanners flagged the domain, providing moderate confidence that malicious components are present.

The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. Technical fingerprinting reveals a modern web stack: Node.js, React, Next.js, Google Cloud services (Trace and CDN), Cloudflare caching, and Webpack bundling. No nameserver records were returned, which is consistent with the domain being temporarily disabled. The campaign’s declared intent is an investment scam targeting users of the Sui blockchain ecosystem. The combination of a convincing page title, legitimate‑looking SSL certificate, and reputable hosting infrastructure increases the likelihood that unsuspecting victims could be lured into providing private keys or transferring funds.

However, the exact content of the page beyond the title has not been captured, leaving the specific phishing mechanics unverified. Defenders should continue to block the domain at network perimeter and proxy layers, update threat intelligence feeds with the observed indicators, and monitor for any resurgence of the same host header or similar subdomains under the typedream.app namespace.