en-suit[.]pages[.]dev

This domain, en-suit.pages.dev, operates as a confirmed crypto wallet drainer targeting users of the Sui blockchain platform. Analysis indicates the site employs brand impersonation techniques to deceive visitors into connecting their cryptocurrency wallets, subsequently facilitating unauthorized transactions and asset theft. The threat specifically exploits trust in the Sui ecosystem by mimicking legitimate wallet interfaces or airdrop claim pages, a common tactic in blockchain-related phishing campaigns. Technical indicators strongly support the malicious classification of this domain. VirusTotal detection metrics reveal that 11 out of 95 security vendors have flagged en-suit.pages.dev as malicious, with one additional security blocklist listing confirming its suspicious status. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on August 28, 2025, and resolves to the IP address 172.66.46.223, hosted under AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the inherent risk, as phishing domains frequently leverage valid certificates to appear legitimate. Users who interacted with en-suit.pages.dev should immediately revoke any wallet connections associated with the domain and transfer assets to a new, secure wallet. All transactions initiated during the interaction period should be audited for unauthorized activity. It is recommended to monitor accounts for signs of compromise, such as unexpected token approvals or balance discrepancies. Given the elevated risk level, affected individuals should also consider reporting the incident to relevant blockchain security teams and law enforcement cybercrime units to aid in tracking the campaign's infrastructure.