sui-web3-network[.]com

This domain is flagged for elevated-risk brand impersonation targeting the Sui Foundation, specifically designed to facilitate cryptocurrency draining operations. Analysis indicates the threat actor leveraged a deceptive interface mimicking legitimate Sui Foundation web properties, as evidenced by the page title 'Sui | Unlock the freedom to build powerful on-chain assets.' The domain was operationalized to exploit users seeking to interact with Sui’s blockchain infrastructure, likely deploying wallet-draining scripts upon connection. Infrastructure analysis reveals the domain was registered on July 15, 2025, through AFRIREGISTER S.A., a registrar historically associated with high volumes of malicious registrations. It resolved to the IP address 95.216.38.171, geolocated in Finland and hosted on AS24940 (Hetzner Online GmbH), a provider frequently abused for phishing and malware distribution. Detection metrics show 11 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on two independent security blocklists. The SSL certificate (R11) further indicates a low-trust, automated issuance typical of phishing infrastructure. Mitigation requires immediate user education on recognizing brand impersonation tactics, particularly in crypto-related contexts. Users should verify domain authenticity by cross-referencing official Sui Foundation communications and avoiding wallet connections to unverified sites. Organizations should implement DNS-based blocking of the domain and its resolving IP, while monitoring for related infrastructure (e.g., subdomains, newly registered lookalike domains). Security teams are advised to correlate this activity with other Hetzner-hosted campaigns targeting blockchain projects, as the hosting provider and registrar combination suggests a broader, recurring threat pattern.