kekec[.]sushiswap[.]tech

Analysis of the domain kekec.sushiswap.tech shows that it was registered through Dynadot LLC on 16 September 2025. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The domain resolves to IP address 172.67.153.21, which belongs to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented; the site serves HTTP only, and the HTTP response currently returns a generic page title "Just a moment…". The site has been taken offline, but historical data indicate it was active prior to removal.

The infrastructure is listed on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal reports that the domain was scanned by 95 AV engines, none of which flagged it at the time of scanning; the absence of detections does not constitute a safety guarantee. The domain is classified as a crypto‑related scam that impersonates the SushiSwap brand, matching the declared brand target and scam type.

Evidence points to a classic brand‑impersonation campaign aimed at deceiving users of the SushiSwap platform, potentially to harvest credentials or lure victims into fraudulent transactions. However, the exact payload, phishing page structure, and any associated command‑and‑control infrastructure remain unknown because the site is no longer reachable for direct inspection. Defenders should continue to block the domain at DNS and proxy layers, add the IP address 172.67.153.21 to network deny lists, and monitor for any resurgence of similar Cloudflare‑hosted domains that use the same registrar or naming patterns. Ongoing threat‑intel feeds should be consulted for new indicators, and any user reports referencing the "Just a moment…" page title should be escalated for further forensic analysis.