springsui[.]xyz

Analysis of the domain springsui.xyz indicates a confirmed phishing operation targeting users of the Sui blockchain platform. The domain was registered on November 11, 2025, through Dynadot LLC and currently resolves to IP address 104.21.49.181. The site's page title, 'SpringSui | Infinitely liquid staking on Sui,' explicitly references Sui, a known blockchain brand, aligning with the reported brand_impersonation threat type. The domain has been flagged by 23 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, including PhishDestroy and BLP-Malware. Five of 95 security vendors on VirusTotal have detected this domain as malicious, further corroborating its high-risk classification. Infrastructure analysis reveals the use of HTTP/3 and a Let's Encrypt SSL certificate, which are common among both legitimate and malicious sites but do not diminish the domain's confirmed malicious status. The domain's Gridinsoft trust score of 0/100 reinforces its classification as a high-risk entity. As of July 12, 2026, springsui.xyz remains active, posing an ongoing threat to users seeking Sui-related services. Defenders should prioritize blocking this domain at the DNS and network levels, and users should be alerted to avoid interacting with any content hosted on this infrastructure. The exact nature of the phishing mechanism—whether credential harvesting, wallet drainer, or fraudulent staking—remains unconfirmed due to the absence of detailed page analysis, but the impersonation of a cryptocurrency brand is evident.