suites-trezoor[.]pages[.]dev

The domain suites-trezoor.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare’s network, resolving to IP address 172.66.44.52 owned by AS13335 Cloudflare, Inc. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services, confirming TLS termination at the edge. HTTP headers indicate the presence of HSTS and the service is delivering HTTP/3 traffic. The landing page returns a 403 status code and the page title reads "Suspected phishing site | Cloudflare," which is the default block page shown when Cloudflare has taken the site offline. The domain is listed on one security blocklist and has been explicitly blocked by PhishDestroy.

Reputation services assign extremely low scores: Scamadviser rates the site 1 out of 100 and Gridinsoft assigns 0 out of 100, both indicating a high likelihood of malicious activity. VirusTotal analysis shows that 11 of 93 scanning engines flagged the domain, reinforcing the suspicion. The domain is identified as a crypto‑related scam that impersonates the brand Sui, as indicated by the intelligence record naming Sui as the target. Infrastructure evidence, including the Cloudflare nameservers brynne.ns.cloudflare.com and ed.ns.cloudflare.com, confirms that the actor leveraged a reputable CDN to obscure origin and to benefit from built‑in security features.

While the site is currently offline, the combination of a recent registration date, low trust scores, multiple vendor detections, and explicit blocklist entries provides concrete indicators of brand‑impersonation intent. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intel feeds, and monitor for any resurgence of the domain or associated subdomains. Organizations that reference the Sui brand should advise users to verify URLs against official channels and to treat any unsolicited communications pointing to this domain as malicious.