cetus[.]cetussdesktop[.]world

The domain cetus.cetussdesktop.world was registered on December 08, 2025 through OwnRegistrar, Inc. and resolves to the IPv4 address 192.3.190.187, which is hosted in the United States under ASN 36352 (HostPapa). The authoritative nameservers are dns1.webproserver.com and dns2.webproserver.com. No TLS certificate is presented, and the site is currently offline.

The page title returned from the host is "Cetus, where On-Chain Trading happens," and the domain is explicitly classified as a brand‑impersonation campaign targeting the Sui ecosystem. Security tooling has recorded one positive detection out of ninety‑five vendors on VirusTotal, and the Gridinsoft trust score is 0 / 100, indicating a high confidence of malicious intent. The domain is listed on three public security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL.

While the page title and classification confirm the impersonation intent, the actual content of the site beyond the title has not been captured, leaving the specific phishing flow and credential‑capture mechanisms uncertain. Defenders should continue to block the domain at network perimeter and endpoint layers, add the associated IP address to deny lists, monitor the registrar for any future registrations that reuse the same nameservers, and consider sharing the indicator set with additional threat‑intel platforms to improve community coverage.