dot-sushi[.]lat

Analysis indicates that the domain dot-sushi.lat, registered through NameCheap on 18 August 2025, is currently active and resolves to the Cloudflare‑owned IP 172.67.188.155 (AS13335, United States). The authoritative nameservers are ashton.ns.cloudflare.com and cheryl.ns.cloudflare.com, confirming that the site is hosted behind Cloudflare’s edge network. The TLS certificate is issued by Google Trust Services under the WE1 identifier, showing a valid HTTPS endpoint despite malicious intent. The site returns an HTTP 302 redirect and presents the page title “Just a moment…”, a pattern commonly used by malicious actors to delay detection. VirusTotal records show that 2 of 95 scanned security vendors have flagged the domain, and the domain appears on four external blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigns a trust score of 0/100, reinforcing the high‑risk assessment. Threat intelligence categorises the activity as a crypto‑scam that impersonates the SushiSwap brand. No further technical artifacts such as malware payloads, credential‑harvesting forms, or specific phishing kits have been disclosed. Consequently, the precise user‑facing content remains unverified. Defenders should block or sinkhole dot‑sushi.lat at the DNS level, monitor outbound connections to the associated Cloudflare IP range, and update intrusion‑prevention signatures to flag HTTP 302 responses from this domain. Incident response teams should also alert users of SushiSwap and advise against interacting with any links referencing dot‑sushi.lat.