suite-en-faq-trzor[.]pages[.]dev

Analysis of suite-en-faq-trzor.pages.dev indicates an active brand‑impersonation campaign targeting the Sui ecosystem. The domain was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 104.21.16.1, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, suggesting that the content has been taken offline or is otherwise inaccessible. Despite the offline status, the infrastructure remains observable: the domain uses Cloudflare’s DNS service (lamar.ns.cloudflare.com, lola.ns.cloudflare.com), enforces HSTS, and supports HTTP/3, all typical of legitimate Cloudflare‑hosted sites.

The presented SSL certificate is issued by Google Trust Services under the identifier WE1, confirming a valid TLS handshake at the time of observation. Security‑vendor telemetry shows that five of ninety‑three VirusTotal scanners flagged the domain, indicating a modest but non‑trivial detection rate. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent.

The available evidence points to a crypto‑scam vector, consistent with the listed scam type, but the exact payload or credential‑harvesting mechanisms have not been captured because the site is presently offline. Defenders should continue to monitor the IP 104.21.16.1 for any reactivation, enforce outbound filtering for URLs referencing this domain, and ensure that threat‑intel feeds ingest the blocklist entries from PhishDestroy. Organizations using Sui‑related services should update internal safe‑browsing lists to include this domain, and SOC analysts should treat any future resolution of the IP as a high‑confidence indicator of a potential Sui‑focused phishing attempt.