trizor--io-suites[.]pages[.]dev

The domain trizor--io-suites.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s edge network (AS13335) with the address 188.114.96.3 located in the United States. The authoritative nameservers are leo.ns.cloudflare.com and elle.ns.cloudflare.com, and the site presents a Google Trust Services / WE1 SSL certificate, indicating that TLS termination is performed by Cloudflare. HTTP requests to the site return a 403 status code and the page title is "Suspected phishing site | Cloudflare," suggesting that the content has been flagged by Cloudflare’s protective services. The domain is listed on a single security blocklist and was actively blocked by the PhishDestroy sinkhole, confirming that it was identified as malicious by external mitigation platforms.

Reputation services score the domain extremely low—Scamadviser assigns a trust score of 1 out of 100 and Gridinsoft reports 0 out of 100—reflecting a consensus of high risk. VirusTotal analysis shows that 12 of 93 scanning engines flag the domain, reinforcing the suspicion of malicious activity. The site advertises a crypto scam and explicitly impersonates the Sui brand, fitting the observed pattern of brand‑impersonation attacks that aim to harvest cryptocurrency credentials or lure victims into fraudulent transactions. Infrastructure observations reveal the use of HSTS, Cloudflare’s HTTP/3 implementation, and standard Cloudflare security headers, which are typical of abuse campaigns that leverage reputable hosting to obscure malicious origins.

At the time of this report the domain is taken offline, but the recorded indicators remain valuable for threat‑intel correlation. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the same host or IP range, and add the observed indicators (domain, IP, nameservers, SSL fingerprint, and associated blocklist entries) to internal threat‑feed feeds.