walletsign-l6g7v0a4nf[.]edgeone[.]app

This domain, walletsign-l6g7v0a4nf.edgeone.app, is flagged for brand_impersonation targeting the Sui blockchain platform. Analysis indicates the site mimics legitimate wallet verification services, presenting a page titled 'WalletSign: Securely Sign & Verify Multi-Chain Messages with Your Browser Wallet | BTC, ETH, SUI, TRON.' The intent appears to deceive users into interacting with a fraudulent interface, potentially leading to credential theft or unauthorized transactions. No explicit drainer kit signatures were identified, but the multi-chain messaging angle suggests a broad targeting strategy. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through MarkMonitor, Inc., and resolves to the IP address 43.152.26.58. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by DigiCert, Inc., which, while legitimate, does not mitigate the underlying threat. No Google Safe Browsing (GSB) detections were noted at the time of analysis. As of the latest assessment, the domain has been taken offline, reducing immediate exposure. However, residual risk persists due to the domain's recent creation and the potential for re-deployment under a different infrastructure. Organizations and users are advised to monitor for similar impersonation attempts, particularly those leveraging multi-chain wallet verification themes. Blocklist integration and endpoint protection rules should be updated to include this domain and its associated IP. Vigilance is recommended for any domains mimicking Sui or other blockchain services, especially those registered through high-reputation registrars but exhibiting low detection rates.