suitesapps-trexxz[.]wixstudio[.]com

This domain, suitesapps-trexxz.wixstudio.com, is identified as a brand impersonation threat targeting Sui, a blockchain platform. The infrastructure was designed to mimic legitimate Sui services, likely to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts. Such impersonation campaigns often facilitate crypto drainer attacks, where victims unknowingly authorize transactions that drain their digital wallets. The use of a subdomain under Wix Studio suggests an attempt to leverage a reputable hosting provider to lend false legitimacy to the operation, while the absence of active content (404 error) may indicate either a takedown or a temporary placeholder state prior to full deployment.

Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 4 out of 95 security vendors on VirusTotal, a relatively low but notable detection rate that suggests emerging or evasive threats. It is registered through GoDaddy.com, LLC, with a creation date of April 27, 2026, which is anomalous as it predates the current date, indicating either a typo in the registration data or an attempt to obscure tracking. The domain appears on one security blocklist and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Detected technologies include Wix, Envoy, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3, which are consistent with modern web applications but also provide avenues for obfuscation. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature.

Users who visited suitesapps-trexxz.wixstudio.com should take immediate action to mitigate potential risks. If any interaction occurred, such as entering credentials or connecting a wallet, affected users should assume compromise and revoke any suspicious smart contract approvals or token allowances using a blockchain explorer or wallet interface. Reset passwords for any accounts accessed during the visit, particularly those linked to cryptocurrency services. Monitor connected wallets and accounts for unauthorized transactions, and consider using hardware wallets or multi-signature solutions for enhanced security. Report the domain to relevant security teams or abuse contacts, such as the hosting provider (Wix Studio) or the registrar (GoDaddy), to aid in further disruption of the infrastructure. Given the elevated risk level, users are advised to remain vigilant for follow-up phishing attempts via email or social engineering.