sui-axelar-usdc[.]chom[.]dev

This domain, sui-axelar-usdc.chom.dev, was identified as a brand impersonation threat specifically targeting users of the Sui blockchain's Axelar USDC bridge. The site masqueraded as an official cross-chain bridge interface, likely designed to deceive victims into connecting wallets or entering private keys under the pretense of facilitating token transfers. The page title, 'Sui Axelar USDC Bridge,' directly mimics legitimate bridge services, increasing the likelihood of user deception, particularly among those familiar with Sui's ecosystem or cross-chain protocols. Analysis of the domain's infrastructure reveals multiple technical indicators supporting its malicious classification. The domain was flagged by 3 out of 95 security vendors on VirusTotal, a relatively low but non-negligible detection rate that suggests either evasion techniques or recent deployment. It was registered through Squarespace Domains II LLC, a registrar commonly used for both legitimate and malicious domains. The domain appears on one security blocklist, indicating prior identification by threat intelligence feeds. Infrastructure analysis further reveals the use of Cloudflare services, including HTTP/3 and HSTS, which are often leveraged to obscure hosting origins and enhance perceived legitimacy. The domain previously resolved to IP address 104.21.91.179, a Cloudflare proxy IP, which is consistent with tactics used to mask the true hosting provider and evade takedown efforts. Users who visited sui-axelar-usdc.chom.dev or interacted with its content should take immediate remediation steps to mitigate potential compromise. First, revoke any wallet permissions or smart contract interactions initiated through the site, as these may grant unauthorized access to connected assets. Monitor all linked accounts and wallets for unauthorized transactions, particularly those involving USDC or other tokens associated with the Sui or Axelar networks. If private keys, seed phrases, or other sensitive credentials were entered, consider the affected wallets compromised and transfer assets to a new, secure wallet immediately. Additionally, scan local devices for malware, as phishing sites may deploy additional payloads to maintain persistence or harvest further credentials. Given the domain's association with cross-chain bridge impersonation, users should verify the authenticity of all future bridge interactions by cross-referencing official project documentation or community-verified channels.