cetus-trade-testnet[.]netlify[.]app

This domain, cetus-trade-testnet.netlify.app, presents a high-risk brand impersonation threat targeting users of the Sui blockchain platform. The site mimics the legitimate Cetus decentralized finance (DeFi) interface, displaying the page title 'Cetus - Empower liquidity. Built for DeFi.' to deceive visitors into interacting with malicious smart contracts or disclosing sensitive credentials. Such impersonation typically facilitates cryptocurrency theft, including wallet-draining attacks, by exploiting trust in established DeFi brands. The domain is designed to harvest private keys, recovery phrases, or authorize fraudulent transactions under the guise of liquidity provision or token swaps. Analysis indicates the domain was registered through Netlify on May 09, 2018, though recent malicious activity suggests compromise or repurposing of existing infrastructure. The site resolves to IP address 63.176.8.218, geolocated in Germany under Amazon.com, Inc. (AS16509), a common hosting provider for both legitimate and malicious content. Detection metrics reveal significant security community consensus: VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on three distinct security blocklists, including PhishDestroy and MetaMask’s internal threat feeds. The SSL certificate, issued by DigiCert Inc, uses the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' intermediate, which does not mitigate the underlying threat. Users who have visited cetus-trade-testnet.netlify.app or interacted with its content should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet. It is critical to verify all recent transactions for unauthorized activity and monitor connected accounts for signs of compromise. If sensitive information such as private keys or seed phrases was entered, assume full account compromise and cease use of the exposed wallet. Browser-based security tools should be updated to block the domain, and users are advised to rely exclusively on verified links from official project sources, avoiding direct navigation via search engines or third-party referrals.