sign[.]sushi-com[.]bond

Analysis of the domain sign.sushi-com.bond indicates a brand‑impersonation campaign targeting SushiSwap users. The domain was registered through Dynadot LLC on 21 October 2025 and resolves to the IP address 142.250.181.228, which belongs to AS15169 Google LLC and is geolocated in the United States. DNS resolution is served by the Cloudflare name servers apollo.ns.cloudflare.com and meera.ns.cloudflare.com, suggesting the use of a reputable CDN for hosting. No TLS certificate is present, meaning the site is served over plain HTTP, which further lowers trustworthiness.

VirusTotal scans show that six of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious activity. Gridinsoft assigns a trust score of 0 out of 100, and the site appears on a single security blocklist, specifically PhishDestroy, which has already taken the domain offline. The page title returned by the web server is "Google," providing no indication of a legitimate SushiSwap landing page or any functional content. The identified scam type is a crypto scam, consistent with the brand‑impersonation motive.

While the limited data set does not reveal the exact payload or phishing flow, the combination of brand impersonation, lack of encryption, low trust scores, and multiple vendor detections warrants elevated risk classification. Defenders should block the domain at DNS and proxy layers, monitor for any related C2 infrastructure, and update detection rules to include the observed name server pair and IP address. Continuous re‑evaluation is advised should additional indicators, such as payload hashes or user‑reporting, become available.