sui--wallet--login[.]pages[.]dev

This domain, sui--wallet--login.pages.dev, presents a high-risk brand impersonation threat designed to deceive users of the Sui blockchain ecosystem. Analysis indicates the site mimics the official Sui Wallet interface, presenting a fraudulent login portal to harvest cryptocurrency credentials or deploy crypto-draining malware. The page title, 'Sui Wallet | Secure Crypto Wallet for Sui Blockchain,' reinforces the deception by closely replicating legitimate branding, increasing the likelihood of user compromise. Infrastructure analysis reveals the domain was configured to exploit trust in decentralized finance platforms, specifically targeting wallet authentication processes to facilitate unauthorized asset transfers or account takeovers. Evidence supporting the malicious classification includes detection by 3 out of 95 security vendors on VirusTotal, a trust score of 0/100 from Gridinsoft, and presence on three independent security blocklists. The domain was registered through Cloudflare, Inc., on April 30, 2026, with an anomalous future creation date suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 188.114.96.3 and employs HTTP/3 and HSTS protocols, which are often leveraged to enhance perceived legitimacy while obscuring malicious intent. The SSL certificate, issued by Google Trust Services, further complicates detection by providing a false sense of security to end users. Users who visited sui--wallet--login.pages.dev should immediately revoke any active wallet sessions and cease all interactions with the domain. It is critical to audit connected wallets for unauthorized transactions, particularly those involving the Sui network, and rotate all credentials associated with cryptocurrency accounts. If credentials were entered, assume they are compromised and transfer assets to a new, secure wallet using a verified client. Monitor for anomalous network activity and report the incident to relevant security teams for further analysis. Proactive measures, such as enabling multi-factor authentication and verifying domain authenticity through official channels, are strongly recommended to mitigate future risks.