presale-hypersui[.]com

Analysis as of July 25 2026 indicates that the domain presale-hypersui.com is being used to impersonate the Sui brand in a cryptocurrency-related scam. The site was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (IP 104.21.30.101, AS13335, United States). The authoritative nameservers are jeremy.ns.cloudflare.com and sue.ns.cloudflare.com. No TLS certificate is presented, meaning the site is served over plain HTTP. The HTTP response returns the generic page title “Just a moment…”, and no further content has been captured, leaving the specific lure or credential-capture mechanism unknown.

Threat intelligence sources have marked the domain as malicious. PhishDestroy has blocked the domain, and it appears on one public security blocklist. VirusTotal reports that 2 of 93 scanning engines have flagged the domain, confirming its malicious nature despite a limited detection count. The scam type is identified as a “Crypto Scam”, aligning with the brand impersonation of Sui, a blockchain platform. Defenders should immediately add presale-hypersui.com to URL and domain blacklists, and consider blocking its hosting IP 104.21.30.101, recognizing that Cloudflare hosts many legitimate services.

Continuous monitoring of newly registered domains using the NiceNIC registrar and of Cloudflare IP ranges for similar patterns is advised. Because the site currently returns a minimal “Just a moment…” page and is offline, there is no active payload, but the infrastructure indicates a potential repeat-use template that could be re-activated. Organizations should educate users about unsolicited cryptocurrency offers tied to the Sui brand and enforce strict verification of any unsolicited communications. Further analysis is warranted if the domain is re-hosted or if additional indicators of compromise emerge.