helpsuite[.]m-pages[.]com

This domain, helpsuite.m-pages.com, was registered on 2026-02-21 and is currently active. It hosts a brand‑impersonation campaign that mimics the Sui cryptocurrency platform, directing victims to a fraudulent site that solicits crypto transfers. The site returns HTTP 302 responses, indicating a redirect to a final landing page that likely contains the phishing lure.

Technical analysis shows the host resolves to 18.156.205.65, an address owned by Amazon.com, Inc. (AS16509) in Germany. The hosting environment uses Amazon Elastic Load Balancing and Amazon Web Services DNS servers (ns-1338.awsdns-39.org, ns-2011.awsdns-59.co.uk, ns-453.awsdns-56.com). The TLS certificate presented is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, a standard publicly trusted certificate.

VirusTotal has flagged the domain by 2 of 95 scanned security vendors, indicating minimal detection at present. The domain appears on two public security blocklists and is listed as blocked by PhishDestroy and PhishingDB. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk classification. Despite the low detection rate, the infrastructure’s use of reputable cloud services may help it evade simple reputation filters.

Defenders should block DNS resolution for helpsuite.m-pages.com and monitor outbound connections to 18.156.205.65. Email gateways should inspect URLs that reference the domain and enforce URL rewriting policies that drop redirects to unknown hosts. Incident response teams should treat any communications referencing Sui that originate from this domain as malicious, and users should be warned to avoid providing cryptocurrency credentials.