pages-trsrsuite-us[.]pages[.]dev

This domain, pages-trsrsuite-us.pages.dev, has been identified as an active phishing infrastructure specifically targeting users of the Sui blockchain platform. Analysis indicates the site employs brand impersonation techniques, presenting itself as an official Sui interface to deceive victims into connecting cryptocurrency wallets. The threat actor appears to be utilizing a wallet drainer kit, which automatically siphons funds upon connection, a common tactic in cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on May 27, 2026, with no associated IP address publicly resolvable due to Cloudflare's proxy service. As of the latest scan, the domain has not been flagged by VirusTotal, showing 0 detections out of 95 security engines. However, it appears on a single security blocklist, suggesting early detection by specialized cryptocurrency threat intelligence sources. The domain remains active and unlisted on Google Safe Browsing, indicating a potential gap in broader security coverage. Current response actions include blocking by at least one security provider, though the domain persists in operation. The risk level remains under investigation due to the discrepancy between the single blocklist detection and the absence of detections in major scanning engines. Users are advised to exercise extreme caution when interacting with any domain impersonating Sui, particularly those hosted on content delivery networks or cloud platforms. Wallet connections should only be made through verified official channels, and transaction confirmations should be scrutinized for unexpected recipient addresses or unusually high gas fees, which may indicate drainer script activity.