trezensuite[.]wixstudio[.]com

Analysis of trezensuite.wixstudio.com indicates an active brand‑impersonation campaign targeting the Sui ecosystem. The domain was registered through GoDaddy.com, LLC on March 22 2026 and resolves to 34.144.206.118, an IP address belonging to Google Cloud in the United States. DNS resolution is served by four nsone.net name servers (dns1.p08.nsone.net through dns4.p08.nsone.net). The site presents a 404 HTTP status with the page title "404 Error: Page Not Found | Wix Studio" and is protected by a valid Let’s Encrypt TLS certificate, confirming HTTPS support.

Infrastructure fingerprints show the use of Wix, Envoy, React, Google Cloud CDN, and HTTP/3, consistent with a typical Wix‑hosted site. Threat intelligence platforms have flagged the domain: nine of ninety‑four VirusTotal scanners flagged it as malicious, it appears on one external blocklist, and PhishDestroy has explicitly blocked it. The domain is currently offline, and its status is recorded as taken offline. Evidence confirms the domain is being used for brand impersonation of Sui, though the exact malicious payload or credential‑harvesting page has not been captured.

Uncertainty remains around the specific phishing workflow, user‑facing content, and any associated command‑and‑control infrastructure, as no further samples or redirects have been observed. Defenders should add the domain to blocklists, monitor DNS queries for the nsone.net name servers, and enforce endpoint protection that flags connections to the 34.144.206.118 IP. Continuous re‑scanning of the domain is advised in case it becomes active again, and security teams should educate users about the Sui brand impersonation threat to reduce successful engagements.