sui-wallet-download[.]pages[.]dev

This domain, sui-wallet-download.pages.dev, is flagged as a brand impersonation threat targeting users of the Sui blockchain platform. Analysis indicates the site was designed to mimic legitimate Sui wallet download pages, likely to distribute malicious software or harvest credentials through deceptive prompts. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with known phishing campaigns targeting cryptocurrency users. The domain exhibits characteristics typical of credential theft operations, including the use of a legitimate-looking interface to exploit user trust in the Sui brand.

Technical indicators reveal the domain was registered on April 05, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.123. Despite its malicious intent, the domain initially evaded detection, with a VirusTotal score of 0/95 at the time of analysis. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. The domain appears on 3 security blocklists, including MetaMask and PhishDestroy, and has a Gridinsoft trust score of 0/100. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare’s automated systems may have flagged it prior to manual review.

As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or security teams. However, the infrastructure remains a potential risk, as threat actors may re-deploy the phishing kit under a new domain or IP address. Users who interacted with the site are advised to revoke any connected wallet permissions, scan for malware, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The low initial detection rate underscores the need for layered security controls, including real-time URL scanning and behavioral analysis, to mitigate similar threats.