app-en-sooi[.]pages[.]dev

Analysis of the domain app-en-sooi.pages.dev indicates a confirmed phishing campaign targeting cryptocurrency users through brand impersonation. The domain, registered through Cloudflare, Inc. on September 2, 2020, currently resolves to the IP address 172.66.46.221, which is associated with Cloudflare's infrastructure (AS13335) in the United States. The page title, 'SuiWallet – Securely Store, Send & Receive Crypto,' suggests an attempt to mimic a legitimate cryptocurrency wallet service, aligning with the reported scam type of wallet/seed phishing. Infrastructure analysis reveals the use of Cloudflare nameservers (adi.ns.cloudflare.com, karl.ns.cloudflare.com, leia.ns.cloudflare.com, logan.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1).

The domain is flagged by 10 of 93 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. The HTTP status code 403, returned at the time of analysis, may indicate recent takedown efforts or access restrictions. Gridinsoft assigns the domain a trust score of 0/100, further corroborating its malicious classification. The domain impersonates 'across,' though the exact nature of this impersonation—whether related to a specific product, service, or platform—remains unclear due to the absence of detailed page content analysis.

Technologies detected on the domain include HSTS, Cloudflare, and HTTP/3, which are consistent with modern web infrastructure but do not mitigate the phishing risk. As of July 24, 2026, the domain has been taken offline, though defenders should remain vigilant for potential re-emergence under similar infrastructure or new domains. Organizations are advised to block the domain and its associated IP (172.66.46.221) at the network level, update endpoint protection signatures to include this indicator, and monitor for related phishing attempts targeting cryptocurrency users.