app-sui-wallet-en[.]pages[.]dev

This domain, app-sui-wallet-en.pages.dev, poses a high-risk brand impersonation threat specifically targeting users of the Sui blockchain platform. Analysis indicates the site was designed to mimic legitimate Sui wallet interfaces, likely functioning as a crypto drainer to harvest credentials and private keys. The domain's infrastructure and content were structured to deceive users into entering sensitive wallet information, enabling unauthorized transactions and asset theft from connected wallets. Evidence supporting this assessment includes detection by 11 out of 95 security vendors on VirusTotal, with the domain appearing on one security blocklist. Infrastructure analysis reveals registration through Cloudflare, Inc. on October 16, 2025, and resolution to the IP address 172.66.44.244, hosted under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), and the page title was flagged as 'Suspected phishing site | Cloudflare.' Google Safe Browsing also categorizes this domain as phishing, further corroborating its malicious intent. Users who visited app-sui-wallet-en.pages.dev should immediately revoke any wallet permissions granted to the site and cease all interactions. If credentials or private keys were entered, affected wallets must be considered compromised. Users should transfer remaining assets to a new, secure wallet and monitor all connected accounts for unauthorized transactions. Additionally, browser data, including cookies and cached files, should be cleared to remove any residual tracking or session persistence. No further interaction with the domain should occur, and users are advised to report the incident to their wallet provider and relevant security teams for further mitigation.