tronhub[.]dev

Analysis of tronhub.dev indicates a high‑risk brand impersonation campaign targeting the Sui brand. The domain was registered on April 23, 2026 through GoDaddy.com, LLC and is hosted on an AWS CloudFront node (IP 3.174.46.57) located in Germany. The authoritative nameservers are ns-1132.awsdns-13.org, ns-1900.awsdns-45.co.uk, and ns-478.awsdns-59.com, reflecting use of Amazon Route 53 DNS services. The site returns HTTP 200 and presents the page title "TronHub - A suite of Tron utilities to help onboard new users and businesses," which does not reference Sui but aligns with the declared scam type of brand impersonation. The SSL certificate is an Amazon RSA 2048 M04 certificate, confirming the use of Amazon‑issued TLS. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports that 6 of 91 scanned security vendors flag the domain, providing additional corroboration of malicious intent. While the page content beyond the title has not been examined, the combination of a recent registration, low trust score, blocklist presence, and multiple vendor detections strongly suggests the domain is being used to deceive users into believing it is associated with Sui. Defenders should add tronhub.dev to URL filtering and sinkhole lists, monitor DNS queries for the listed nameservers, and enforce TLS inspection to detect any credential‑harvesting activity. Continuous re‑evaluation is advised as additional intelligence may emerge.