sui-shell[.]vercel[.]app

The domain sui-shell.vercel.app was registered on 2026-02-21 through Tucows Domains Inc. It resolves to IP 216.198.79.3, which is assigned to Amazon.com, Inc. (AS16509) located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WR1 designation and enforces HSTS, indicating use of the Vercel hosting platform. An HTTP GET returns status 200 and the page title is “sui-shell one shell manager based on sui network”, matching the declared brand target “sui”. Google Safe Browsing classifies the URL as “SOCIAL_ENGINEERING”, and a single security vendor on VirusTotal flagged the domain (1/95). The Gridinsoft trust score is 0/100, and the domain appears on one public blocklist, currently blocked by PhishDestroy. The overall risk is high and the campaign remains active. Evidence suggests a brand‑impersonation attempt leveraging the Sui brand to lure victims, but the exact payload and credential‑collection mechanism have not been publicly disclosed. Defenders should block the domain and its resolving IP at perimeter and DNS layers, monitor for outbound connections to the associated Amazon address, and update detection rules to flag URLs containing the observed page title or certificate attributes. Ongoing collection of network traffic and user reports is recommended to confirm any additional malicious infrastructure.