officialt-trezsuites[.]wixstudio[.]com

This domain, officialt-trezsuites.wixstudio.com, is flagged as a brand impersonation threat targeting the Sui blockchain ecosystem. Analysis indicates the infrastructure was designed to mimic legitimate Sui-related services, likely to deceive users into disclosing sensitive credentials or authorizing malicious transactions. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and timing align with known impersonation tactics used in cryptocurrency fraud campaigns. The page currently displays a 404 error, which may indicate a temporary takedown or evasion attempt by the operators. Infrastructure analysis reveals the domain was registered on April 27, 2026, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Security vendor assessments on VirusTotal show 13 out of 95 engines flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist, specifically PhishDestroy, and employs technologies such as Wix, React, Google Cloud CDN, and HTTP/3. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. As of the latest assessment, the domain is offline, likely due to takedown efforts or operational changes by the threat actors. However, the elevated risk persists due to the domain’s recent creation, association with brand impersonation, and prior malicious activity. Users and organizations are advised to block the domain and its resolving IP at the network level, monitor for similar impersonation attempts, and verify all Sui-related communications through official channels. The presence of Google Cloud infrastructure suggests potential for rapid redeployment, warranting continued vigilance.