walrus-protocol[.]fun

On 22 August 2025 the domain walrus-protocol.fun was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to the IP address 66.33.60.193, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site was observed presenting the page title “Walrus Claiming Portal” and was classified as a brand‑impersonation campaign targeting the Sui brand. The SSL certificate associated with the host is identified as “R12”, indicating that TLS was in use at the time of collection.

Automated analysis by Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in legitimacy. VirusTotal scans reported that five of ninety‑three AV engines flagged the domain as malicious, and the domain is listed on a single external blocklist, specifically PhishDestroy. The current operational status is offline, and the domain has been taken down. The evidence suggests that the infrastructure was leveraged to lure victims into believing they were interacting with a legitimate Sui portal, likely to harvest credentials or other sensitive data.

Uncertainty remains regarding the exact payload delivered, the duration of active exploitation, and whether additional infrastructure such as command‑and‑control servers was associated with the same IP range. Defenders should add walrus‑protocol.fun to their deny‑list, monitor for any resurgence of the domain or related IPs, and enforce strict URL filtering for the “Walrus Claiming Portal” title pattern. Network traffic to the associated Amazon IP should be inspected for anomalous request patterns, and endpoint protection policies should be updated to include the five VirusTotal‑detected signatures. Continuous threat‑intel feeds should be consulted for any re‑registration attempts or new indicators that reuse the same registrar or hosting provider.