confirmation-id09499[.]com

This domain, confirmation-id09499.com, is flagged as an active brand impersonation campaign targeting Sui, a prominent cryptocurrency platform. Analysis indicates the site mimics legitimate Sui authentication or transaction confirmation portals, likely designed to deceive users into disclosing wallet credentials or approving malicious transactions. No explicit crypto drainer kit signatures have been identified, but the domain’s structure and timing align with known wallet-drain patterns observed in prior Sui-themed attacks. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Hello Internet Corp, a registrar frequently associated with high-risk domains. The site employs Cloudflare hosting and HTTP/3 protocol, which may obscure originating IP addresses and complicate attribution. As of the latest assessment, VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and OISD, and has been documented in eight threat intelligence pulses on AlienVault OTX. No detections were recorded in Google Safe Browsing at the time of analysis. The domain remains active, with no evidence of takedown or mitigation efforts. Users are advised to treat any interaction with confirmation-id09499.com as hostile, particularly communications or prompts related to Sui wallet verification, token claims, or transaction confirmations. Organizations should update internal blocklists and monitor for related infrastructure, including subdomains or newly registered domains sharing the same registrar or hosting patterns. Given the elevated risk level and persistent activity, continued vigilance is recommended for cryptocurrency users and security teams.