trezroisuite[.]m-pages[.]com

The domain trezroisuite.m-pages.com was registered on 15 April 2026 and is currently active. It is classified as a brand‑impersonation campaign targeting the Sui brand. The domain resolves to the IPv4 address 3.73.4.14, which is hosted on an Amazon Web Services EC2 instance in the eu‑central‑1 region (Germany). Infrastructure analysis shows the site uses a Sectigo Limited public‑server authentication DV certificate issued by the Sectigo Public Server Authentication CA DV R36. The certificate was obtained through MarkMonitor Inc., a registrar commonly associated with legitimate brand owners, indicating that the attackers deliberately leveraged a trusted CA to increase credibility. The domain’s authoritative name servers are ns-1338.awsdns-39.org, ns-2011.awsdns-59.co.uk, ns-453.awsdns-56.com, and a fourth AWS DNS server, confirming full reliance on AWS DNS infrastructure. Web request to the domain returns HTTP 404, suggesting that no landing page is currently deployed or that the site serves content only after specific triggers. VirusTotal analysis reports that 3 of 95 security scanners flag the domain as malicious, which, combined with its inclusion on a single security blocklist and the fact that PhishDestroy has already blocked it, indicates a limited but confirmed detection footprint. The limited number of detections may reflect a recent deployment or low‑volume targeting. Given the high‑risk rating, defenders should block traffic to trezroisuite.m-pages.com at perimeter and DNS layers. Continuous monitoring of the associated IP address and AWS name server changes is advised, as attackers may later activate payloads or redirect to phishing pages. Organizations using the Sui brand should educate users about the impersonation risk and employ email and web‑gateway filters that reference the domain and its IP. Incident response teams should collect TLS handshake data and any future HTTP responses for forensic correlation.