sui-play[.]airdropsalert[.]live

This domain, sui-play.airdropsalert.live, was registered on 21 February 2026 through Dynadot LLC and resolves to the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. The site returned HTTP 200 responses when it was live, and its page title was identical to the fully qualified domain name. Analysis of threat intelligence indicates that the page was part of an airdrop‑scam kit specifically targeting the Sui blockchain brand, presenting a fake airdrop claim to lure victims. Google Safe Browsing classified the site as a social‑engineering threat, and 14 of 95 VirusTotal scanners identified it as malicious, confirming a high confidence of abuse.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy remediation service. Current operational status is offline, suggesting the phishing campaign has been taken down or the hosting has been suspended. Defenders should add sui-play.airdropsalert.live to existing URL filtering and DNS sink‑hole rules, monitor for any re‑hosting attempts, and treat any traffic to the domain as hostile.

Because the kit is known to distribute credential‑stealing or wallet‑draining payloads, endpoint detection solutions should be tuned to flag any file or script hashes observed in related campaigns. Continuous observation of Dynadot‑registered domains that reference “airdropsalert” or similar naming patterns is recommended, as the registrar has historically been used for rapid deployment of fraudulent airdrop sites. Until the infrastructure is fully dismantled, organizations handling Sui‑related assets should remain vigilant for phishing emails that reference the domain or the “Sui Play” phrasing.