suiteapps-trezon[.]wixstudio[.]com

Analysis of suiteapps-trezon.wixstudio.com indicates a brand‑impersonation campaign targeting the Sui ecosystem. The site was registered through GoDaddy.com, LLC on 17 December 2016 and is currently resolved to 34.144.206.118, an address owned by Google LLC (ASN 396982) located in the United States. The hosting environment uses Wix infrastructure, with technologies such as React, Lodash, Google Cloud CDN, HSTS and HTTP/3 detected, and the site presents a Let’s Encrypt R13 certificate. The page title retrieved from the live endpoint reads “Official Trezor™ Suite® — Desktop & Web App for Hardware Wallets,” which does not reference the Sui brand but demonstrates a generic cryptocurrency‑wallet theme often employed in impersonation attempts.

The HTTP response is a 404 status, and the domain is presently taken offline, yet the same host continues to be listed on three independent blocklists (PhishDestroy, MetaMask, SEAL). VirusTotal scans show three of ninety‑one security vendors flagging the domain, reinforcing the malicious classification. The combination of a long‑standing registration, use of reputable cloud services, a valid TLS certificate, and explicit inclusion on multiple anti‑phishing feeds suggests deliberate infrastructure preparation rather than a transient typo‑squat.

No further content analysis is available, so the exact phishing page layout cannot be confirmed. Defenders should continue to block the domain at network perimeters, add the IP address to threat‑intel feeds, and monitor for any re‑activation or replication of the same host pattern. Ongoing observation of the associated AS and any future TLS certificates is advised to detect potential re‑use by the same actors.