tangem[.]suitechecker[.]com

Analysis of tangem.suitechecker.com indicates that the domain is being used for a crypto‑related brand impersonation campaign targeting users of the Sui blockchain. The site’s HTML title reads “Tangem – Transaction Check”, which aligns with the reported scam type “Crypto Scam” and the declared impersonation of the Sui brand. The domain was registered on 21 February 2026 through Porkbun LLC and is served from the IP address 136.243.231.49, an address owned by Hetzner Online GmbH in Germany (AS24940). DNS resolution uses three nameservers operated by machineasp.net (ns1, ns2, ns3). The web server responds with HTTP 503 and identifies Microsoft HTTPAPI as the underlying technology.

An SSL certificate issued by Let’s Encrypt (R13) is present, confirming that TLS is correctly configured but offering no indication of legitimacy. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as malicious. VirusTotal reports that 15 of 93 scanning engines flag the host as malicious, reinforcing the suspicion of abusive activity. As of the report date the site is reported offline, which may be a temporary takedown or a deliberate shutdown after a campaign phase. Defenders should treat any traffic to tangem.suitechecker.com as hostile.

Network‑level controls such as domain‑based blocklists, DNS sinkholing, or firewall deny rules should be applied to prevent connections to the associated IP and its hostnames. Because the infrastructure is hosted on a reputable cloud provider, threat actors can quickly relocate, so monitoring for newly registered domains that resolve to the same IP range or that use the same nameserver set is advisable. Analysts should also watch for future observations of the “Tangem – Transaction Check” page title or similar Sui‑related keywords in logs, as these may indicate a resurgence of the campaign.