phi-sushi[.]lat

The domain phi-sushi.lat was registered on 21 February 2026 and is currently offline. Technical analysis shows it resolves to the IP address 104.21.80.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate identified as WE1, indicating a valid SSL layer, but the Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. The page title returned by the server is "Cierpliwości...", which does not correspond to any known SushiSwap terminology and suggests that the content has not been publicly disclosed.

The domain is listed on four security blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal scans report that one out of ninety‑three security vendors flagged the domain, providing additional confirmation of malicious intent. The threat actor appears to be impersonating the decentralized exchange brand SushiSwap, and the associated scam type is classified as a crypto scam. While the offline status limits immediate threat exposure, the infrastructure—particularly the use of a reputable CDN provider—could be reused for future campaigns.

Defenders should continue to monitor the IP address 104.21.80.1 for any re‑activation, enforce blocklist entries for phi-sushi.lat across perimeter defenses, and consider adding the domain to internal threat intel feeds. Additional investigation is required to retrieve the original page content and to determine whether the certificate WE1 is tied to a known phishing kit. Until the domain reappears, vigilance is advised for any new domains that resolve to the same Cloudflare IP range and exhibit similar low trust scores.