en-suite-help-start[.]pages[.]dev

This domain, en-suite-help-start.pages.dev, was identified as part of a crypto scam infrastructure impersonating Sui, a known blockchain platform. Registered on February 21, 2026, through Cloudflare, Inc., the domain resolved to IP address 172.66.44.224, hosted on Cloudflare's network (AS13335) in the United States. The domain is currently offline, returning an HTTP 403 status, and is flagged by Cloudflare with the page title 'Suspected phishing site | Cloudflare.' Analysis indicates it appears on one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0/100, reflecting high-risk classification. Infrastructure analysis reveals the use of Cloudflare technologies, including HSTS and HTTP/3, with SSL certification issued by Cloudflare TLS Issuing ECC CA 3.

While VirusTotal shows only one security vendor flagging this domain, the absence of broader detection does not confirm safety, as the domain may not have been widely scanned or could employ evasion techniques. The domain's registration details and hosting on Cloudflare align with patterns observed in phishing campaigns targeting cryptocurrency users, though the exact mechanics of the scam (e.g., wallet drainer, fake token sale) remain unconfirmed due to the lack of accessible page content. Defenders should treat this domain as high-risk due to its association with brand impersonation, crypto scam classification, and existing blocklist inclusion. Although currently offline, the domain could be reactivated or reused for similar campaigns.

Monitoring for DNS changes, SSL certificate updates, or shifts in HTTP status is recommended. If internal logs or network traffic indicate prior access to this domain, incident response procedures for potential credential theft or wallet compromise should be initiated. No further visual or behavioral analysis of the site is available at this time.