rndrsushi[.]top

Analysis of the domain rndrsushi.top indicates active brand impersonation targeting SushiSwap, a decentralized finance platform. The domain was registered on May 18, 2026, through Dynadot LLC and currently resolves to the IP address 188.114.97.3, which is associated with CloudFlare, Inc. in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (buck.ns.cloudflare.com and emily.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial number E8), which are common in both legitimate and malicious deployments. The domain returns an HTTP 302 redirect status, suggesting it may be part of a multi-stage redirection chain, though the final destination remains unconfirmed. Security vendors have flagged this domain with varying levels of detection: four of 92 engines on VirusTotal classify it as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and has been included in one AlienVault OTX threat intelligence pulse. Additional defensive measures include blocking by PhishDestroy, MetaMask, and SEAL, indicating targeted mitigation efforts against this campaign. The page title, 'Staking | Sushi 🍣', directly references SushiSwap's branding and functionality, reinforcing the likelihood of brand impersonation. Defenders should treat this domain as high-risk due to its active status, confirmed brand targeting, and cross-vendor detections. Network-level blocking of the IP 188.114.97.3 and domain-level filtering of rndrsushi.top are recommended. Given the use of Cloudflare infrastructure, additional scrutiny of related domains or IPs within the same provider may be warranted to identify associated threats. The exact content and functionality of the site remain unanalyzed, so further investigation into redirection chains or payload delivery is advised.