suiwallet-cloud[.]pages[.]dev

This domain, suiwallet-cloud.pages.dev, is identified as a brand impersonation threat specifically targeting Ethereum users. The site presents itself as a legitimate cryptocurrency wallet service, using the page title 'Sui Wallet – Securely Store, Send & Receive Crypto: The Definitive Guide' to lure victims into interacting with malicious infrastructure. Analysis indicates the intent is likely to facilitate crypto asset theft, such as draining wallets or harvesting credentials, by exploiting trust in established blockchain brands. The use of a misleading title and Ethereum branding suggests a calculated effort to deceive users familiar with crypto storage solutions. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on November 10, 2025, through Cloudflare, Inc., and resolves to the IPv6 address 2a06:98c1:3121::3, hosted on AS13335 under Cloudflare’s network in the United States. Detection metrics further corroborate the threat: VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while one additional security blocklist has listed it. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing campaigns frequently leverage valid certificates to appear legitimate. The domain’s rapid takedown aligns with typical phishing lifecycle patterns, where malicious actors quickly rotate infrastructure to evade detection. Users who visited suiwallet-cloud.pages.dev or interacted with its content should take immediate remedial actions. Any credentials, wallet addresses, or private keys entered on the site must be considered compromised and should be revoked or transferred to new, secure wallets. Affected individuals should conduct a thorough audit of connected devices for malware, particularly browser extensions or scripts that may have been installed. Wallet applications should be verified for unauthorized transactions, and users are advised to enable multi-factor authentication on all crypto-related accounts. Monitoring for unusual activity on linked email or exchange accounts is also recommended, as secondary compromise may occur through phishing-derived credentials.