sui-wallet-extnsonn[.]typedream[.]app

Analysis as of July 24 2026 indicates that the domain sui-wallet-extnsonn.typedream.app is hosted on Cloudflare infrastructure (IP 172.67.206.36, AS13335, United States). The domain was registered through Cloudflare, Inc. and resolves to a Cloudflare edge node that serves content over HTTPS using a Google Trust Services certificate (issuer WE1). Although the TLS certificate is valid, it does not verify the legitimacy of the site. The site returns HTTP 404, confirming that the content is currently unavailable, and the domain has been taken offline. The page title retrieved from the HTTP response is “Sui Wallet Extension™ | Your Gateway to Secure Web3 on the Sui Blockchain”, directly referencing the Sui brand and suggesting a cryptocurrency wallet extension.

The domain is classified as a crypto‑related brand impersonation, targeting users of the Sui blockchain. VirusTotal scans show that eleven of ninety‑five security vendors flagged the domain, indicating a moderate detection consensus. The domain appears on one security blocklist and is listed as blocked by PhishDestroy, reinforcing its malicious reputation. Infrastructure fingerprints reveal a modern web stack: Node.js, React, Next.js, Google Cloud services (CDN, Trace) and Cloudflare Browser Insights, consistent with a typical impersonation‑hosting environment that leverages reputable CDNs to obscure the origin.

Nameserver information could not be retrieved (NS_NOT_FOUND), limiting visibility into DNS authority and complicating attribution. No additional content analysis is available beyond the page title; therefore the exact malicious payload, credential‑harvesting mechanisms, or transaction‑draining behavior remain unverified. Defenders should continue to block the IP address 172.67.206.36 and the domain itself at network perimeter, update endpoint and web‑filtering solutions with the observed indicators, and monitor for newly registered subdomains under the typedream.