walletsign-twhdrl8rvj[.]edgeone[.]app

The domain walletsign-twhdrl8rvj.edgeone.app is identified as a brand impersonation threat targeting users of the Sui blockchain platform. Analysis confirms this domain is designed to mimic legitimate wallet signature and verification services, specifically aiming to harvest cryptocurrency wallet credentials or private keys. The domain is currently offline, but prior activity indicates elevated risk due to its deceptive infrastructure and targeted phishing tactics. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. It resolves to the IP address 43.152.26.58 and was created on February 21, 2026, suggesting a potentially short-lived or disposable operational timeline. The domain appears on one security blocklist, and VirusTotal reports that 2 of 95 security vendors flagged it as malicious. The SSL certificate is issued by DigiCert, Inc., specifically a DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1, which does not inherently indicate malicious intent but is often abused in phishing campaigns to lend false legitimacy. Current status indicates the domain has been taken offline, reducing immediate exposure risk. However, historical indicators suggest this was part of a larger campaign targeting cryptocurrency users. Organizations and individuals are advised to block the domain and associated IP at the network level. Users who interacted with this domain should immediately revoke any wallet permissions, transfer assets to a new secure wallet, and monitor for unauthorized transactions. Security teams should treat this domain as part of a broader threat cluster and investigate related infrastructure for similar impersonation attempts.