updated-sushiswap-v2[.]pages[.]dev

PhishDestroy identifies the active domain updated-sushiswap-v2.pages.dev as an elevated-risk crypto drainer impersonating the legitimate SushiSwap protocol. This fraudulent site uses a Pages.dev subdomain to masquerade as an updated version of SushiSwap’s v2 interface, deploying a cryptocurrency drainer kit designed to siphon user wallet funds during transaction approvals. The domain leverages brand deception to exploit trust in DeFi infrastructure, specifically targeting users interacting with decentralized exchanges.

This domain exhibits multiple technical indicators of malicious intent. According to VirusTotal analysis, 2 out of 95 security engines flagged the URL as malicious. The site resolves to IP address 188.114.97.3, hosted via Cloudflare, Inc., which serves as both a CDN and privacy shield for the threat actor. Notably, this infrastructure has bypassed Google Safe Browsing (GSB) detection as of current scans, increasing its potency in phishing campaigns. While the domain's exact creation date is not publicly disclosed, its operational status is confirmed active and linked to ongoing impersonation of SushiSwap’s brand identity.

As of this investigation, updated-sushiswap-v2.pages.dev remains active and unblocked by major threat intelligence platforms. PhishDestroy has flagged this domain as high-risk and added it to internal blocklists with priority response. Users attempting to access this domain should expect full blocking through PhishDestroy’s protective services. However, the risk remains elevated due to the use of legitimate cloud hosting (Cloudflare) and a valid Google Trust Services SSL certificate, which may temporarily deceive cautious users. The current threat level is elevated, and all SushiSwap users are advised to verify official communication channels and never interact with third-party domains offering 'updated' or modified interfaces. PhishDestroy will continue monitoring this domain and updating threat feeds accordingly.