guide--trezo--suites[.]pages[.]dev

The domain guide--trezo--suites.pages.dev was observed delivering a brand‑impersonation campaign targeting the Sui ecosystem. The site returned HTTP 403, indicating that the content is currently inaccessible; the domain has been taken offline according to the latest status. DNS resolution points to 172.66.46.225, an address owned by AS13335 Cloudflare, Inc. and located in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, and the connection supports HSTS and HTTP/3, consistent with Cloudflare‑provided hosting.

Registration data shows the domain was created on 21 February 2026 through Cloudflare, Inc., and the authoritative nameservers are langston.ns.cloudflare.com and samara.ns.cloudflare.com. VirusTotal analysis recorded eight positive detections out of ninety‑three scanned security vendors, confirming malicious classification. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single external blocklist, PhishDestroy. The listed scam type is “Crypto Scam,” suggesting the campaign may have attempted to lure victims into fraudulent cryptocurrency transactions, although the exact payload or phishing page content has not been captured because the site is currently inaccessible.

Current evidence does not reveal additional infrastructure such as command‑and‑control servers, nor does it disclose any payload hashes or URLs beyond the primary domain. Defenders should block the domain and its resolved IP at perimeter defenses, update URL filtering and DNS sinkhole rules, and monitor for any newly registered subdomains under the same Cloudflare account. Continuous re‑query of VirusTotal and other reputation services is advised to capture any future detections. Because the domain was registered only months ago, threat‑intel teams should watch for similarly patterned names that reuse the “guide--trezo--suites” token, as this may indicate an automated naming scheme used by the same actor.