suiwallet[.]xin

The domain suiwallet.xin was observed on July 12, 2026 targeting the Sui brand. The page title returned by the server is “Create Sui Wallet | Generate & Sign Up”, indicating a brand‑impersonation campaign that attempts to lure users into creating a fraudulent Sui wallet. The threat is classified as high risk and remains active. Registration details show the domain was created on 26 November 2025 and was registered through Dominet (HK) Limited. Authoritative DNS is served by ns7.alidns.com and ns8.alidns.com. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate version E7), which masks the underlying malicious intent. Network resolution points to IP address 77.110.112.56, hosted in Russia and owned by AS207713 GLOBAL INTERNET SOLUTIONS LLC. VirusTotal has flagged the domain in 14 out of 95 security vendors, and the domain appears on one external blocklist. The site’s SSL configuration, combined with a Gridinsoft trust score of 0/100, suggests an extremely low reputation. HTTP requests receive a 302 redirect, a typical technique used to evade static analysis. Additionally, the domain is listed as blocked by PhishDestroy, reinforcing the confidence that it is being used for cryptocurrency‑related fraud. While the exact page content has not been captured, the combination of a brand‑specific title, a recent registration, a Russian‑based hosting infrastructure, and multiple independent detection signals strongly indicate a credential‑harvesting or wallet‑draining operation. Defenders should block suiwallet.xin at network perimeters, add the associated IP 77.110.112.56 to deny‑list rules, and monitor for related DNS queries to the alidns.com nameservers. Continuous re‑evaluation is advised in case the infrastructure evolves or additional indicators emerge.