trezosuite[.]org[.]in

This domain, trezosuite.org.in, is identified as an active crypto drainer targeting users of the Sui blockchain platform. Analysis indicates the site employs brand impersonation techniques to deceive visitors into connecting wallets or entering sensitive credentials, which are subsequently exfiltrated to attacker-controlled infrastructure. The page title, 'Tideline Stargazing Log,' serves as a social engineering lure, likely designed to mimic legitimate Sui-related projects or community initiatives to lower user suspicion. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 1, 2024, through Dynadot, LLC, and currently resolves to the IP address 188.114.96.3. Detection metrics show 13 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on three independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy, a common tactic in phishing campaigns to evade user scrutiny. Users who have visited trezosuite.org.in or interacted with its content should take immediate remedial action. Disconnect any connected wallets from the site and revoke all associated smart contract approvals using a blockchain explorer or dedicated revocation tool. Monitor connected accounts for unauthorized transactions and consider migrating funds to a new wallet if credentials were entered. Report the domain to relevant security teams and blocklists to assist in broader mitigation efforts. Given the high-risk nature of this campaign, affected users are advised to assume compromise and conduct a full security review of their systems and connected services.