en-g--suites[.]pages[.]dev

The domain en-g--suites.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and is currently hosted on Cloudflare’s edge network (AS13335, United States). The authoritative name servers are houston.ns.cloudflare.com and veda.ns.cloudflare.com, and DNS resolution returns the IPv6 address 2606:4700:310c::ac42:2ed9. The site presents a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that the content has been taken offline. Despite the offline status, threat intelligence flags the domain as a crypto‑related brand‑impersonation campaign targeting the Sui brand.

VirusTotal records show that one of ninety‑three scanning engines flagged the domain, and the site appears on a single external blocklist, where it has also been blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a valid TLS certificate. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The observed technologies include HTTP/3 and enforced HSTS, both typical of Cloudflare‑protected services.

At present, no additional content or login pages have been captured, so the exact phishing vector and payload remain unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation, and add the IPv6 address to threat‑intel feeds. Because the domain impersonates Sui and is classified as a crypto scam, security teams should alert users of the Sui ecosystem and consider broader watch‑lists for related brand‑impersonation domains.