reward-sui[.]top

reward-sui.top was observed to resolve to the IP address 54.192.34.180, which belongs to the ASN AS16509 owned by Amazon.com, Inc. and is geolocated in Germany. The domain uses Cloudflare’s authoritative nameservers paul.ns.cloudflare.com and violet.ns.cloudflare.com, indicating the infrastructure is protected by Cloudflare’s CDN. No TLS certificate was presented when the host was queried, confirming the absence of HTTPS support. The domain was registered on 23 October 2025 through NiceNIC International Group Co., Limited. Its page title reads “Amazon.com”, and the threat intelligence tags it as an Amazon brand impersonation associated with a crypto‑scam campaign. VirusTotal scans returned 14 detections out of 95 security vendors, and the domain appears on a single public blocklist.

Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX references the domain in one pulse. PhishDestroy has listed the host as blocked. The current status is offline, suggesting the site has been taken down or is no longer serving content. Analysis indicates that the attacker leveraged a legitimate Amazon‑owned IP range to host a malicious site, likely to increase credibility and evade simple IP‑based blocking. The lack of an SSL certificate may have limited its ability to exfiltrate credentials, but the presence of a crypto‑scam label implies that victims could have been prompted to send cryptocurrency payments.

The combination of Cloudflare DNS, a zero‑trust score, and multiple vendor detections confirms a high confidence of malicious intent. Uncertainty remains around the specific payload or phishing page content, as no visual evidence was captured. Defenders should continue to block reward‑sui.top at DNS and network layers, monitor for any re‑registration or reuse of the IP address, and add the domain to internal blocklists.