suivision-xyz[.]webflow[.]io

This domain, suivision-xyz.webflow.io, poses a targeted brand impersonation threat against Sui, a Layer 1 blockchain platform. The site mimics SuiVision, an official Sui blockchain explorer, presenting itself as a legitimate interface for viewing transactions, wallet balances, and network activity. Analysis indicates the domain is designed to deceive users into entering sensitive credentials or interacting with malicious smart contracts, potentially leading to unauthorized access or asset theft. The page title, 'SuiVision | Sui Explorer - Home,' reinforces the deception by replicating the branding of the authentic Sui ecosystem tools. Evidence supporting the malicious classification includes detection by 11 out of 95 security vendors on VirusTotal, indicating a consensus among threat intelligence sources regarding its fraudulent nature. The domain is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains, and was originally created on May 8, 2013, though the subdomain appears to have been repurposed for this campaign. Infrastructure analysis reveals the domain resolves to 172.64.151.8, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to conceal the true origin of the server. The domain is currently listed on one security blocklist, further corroborating its association with phishing activity. Users who visited suivision-xyz.webflow.io should assume their interactions may have been compromised. Immediate actions include revoking any active sessions or permissions granted to the site within blockchain wallets or applications. Affected users should also scan their systems for malware or unauthorized extensions, particularly those targeting cryptocurrency wallets. If credentials or private keys were entered, users must transfer assets to a new wallet and monitor all linked accounts for suspicious transactions. Given the domain’s current offline status, users should remain vigilant for similar impersonation attempts using alternative domains or subdomains, as threat actors frequently rotate infrastructure to evade detection.