hypersuid[.]pages[.]dev

This domain, hypersuid.pages.dev, is flagged for brand impersonation targeting users of Hyperliquid, a decentralized perpetuals exchange. The site presents itself as a legitimate token presale under the name 'HyperSUI Presale — Powering the Future of Perp Trading,' but analysis indicates it is designed to deceive visitors into connecting cryptocurrency wallets. Once connected, the site may execute unauthorized transactions, draining funds from victims' wallets without consent. The threat type is classified as a crypto drainer, a specialized form of phishing that directly targets digital asset holdings rather than traditional credentials. Infrastructure analysis reveals the domain was registered on January 6, 2026, through Cloudflare, Inc., a provider commonly used to mask malicious infrastructure. The domain resolves to the IP address 172.66.45.14 and uses an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy. At the time of investigation, the domain had zero detections across 95 security engines on VirusTotal, indicating it has not yet been widely flagged by automated systems. However, it appears on at least one security blocklist, suggesting prior detection by manual or heuristic analysis. Users who have visited hypersuid.pages.dev or interacted with its content should take immediate action. Disconnect any wallets previously linked to the site and revoke all associated smart contract approvals using a blockchain explorer or wallet security tool. Monitor connected accounts for unauthorized transactions and consider transferring remaining funds to a new, secure wallet. Report the domain to relevant security platforms and cryptocurrency communities to prevent further victimization. Given the domain's recent creation and low detection rate, heightened vigilance is recommended when encountering similar presale or investment opportunities.