site-l2pxkyyme[.]godaddysites[.]com

This domain, site-l2pxkyyme.godaddysites.com, is flagged as a brand impersonation threat targeting Sui, a cryptocurrency platform. Analysis indicates the domain was designed to mimic official Sui communication channels, potentially to deceive users into disclosing sensitive credentials or transferring digital assets. The page title, serrvice-mailsuisse00, suggests an attempt to spoof a Swiss-based service, though no direct evidence of a crypto drainer kit or wallet-draining malware was observed in this instance.

Infrastructure analysis reveals the domain was registered through GoDaddy Sites and resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was created on November 18, 2013, though the malicious activity appears to have been hosted more recently. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, a common certificate authority for both legitimate and malicious domains. No Google Safe Browsing (GSB) detection was explicitly noted in the available data.

As of the latest assessment, the domain has been taken offline, likely due to detection and reporting by security vendors. While the immediate threat has been mitigated, the infrastructure remains a potential risk for future malicious campaigns. Users who may have interacted with the domain are advised to monitor for unauthorized transactions, rotate credentials, and verify the authenticity of any communications claiming to be from Sui or related services. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.