sui-wallet[.]blogspot[.]com

Analysis of sui-wallet.blogspot.com indicates this domain was actively impersonating the Sui cryptocurrency platform as part of a crypto scam campaign. The domain, registered on February 21, 2026, through MarkMonitor, Inc., resolved to a Google LLC-hosted IPv6 address (2607:f8b0:4004:c19::84) within AS15169. Infrastructure analysis reveals the use of Blogger platform technologies, including Java, Python, OpenGSE, and HTTP/3, with nameservers pointing to blogspot.l.googleusercontent.com. The domain's SSL certificate was issued by Google Trust Services (WE2), consistent with legitimate Blogger properties, though this does not preclude malicious use.

As of the report date, the domain returns an HTTP 404 status with the page title 'Blog introuvable,' suggesting it has been taken offline or removed by the hosting provider. It appears on one security blocklist (PhishDestroy), while VirusTotal scans from 93 vendors show no current detections, though the absence of flags is not conclusive evidence of safety. The domain's creation date, registrar, and hosting on a major platform align with patterns observed in transient phishing campaigns, where attackers leverage reputable services to evade initial detection. Defenders should note that while the domain is currently offline, its infrastructure (Google-hosted Blogger) remains accessible for potential reuse.

The single blocklist appearance and lack of widespread vendor detection may indicate either a newly emerged threat or one that was quickly mitigated. Historical DNS and WHOIS records should be preserved for retrospective analysis, and monitoring for re-registration or similar domains (e.g., variations of 'sui-wallet') is recommended. Given the crypto scam classification, security teams should check for related wallet addresses or transaction patterns in internal logs, particularly if the domain was accessed by users prior to takedown.