sushiswap-upgraded-v2[.]pages[.]dev

Analysis indicates that the domain sushiswap-upgraded-v2.pages.dev was registered on 15 Oct 2025 through Cloudflare, Inc. The domain resolves to IP 172.66.47.64, which belongs to AS13335 operated by Cloudflare in the United States. DNS resolution uses the Cloudflare nameservers journey.ns.cloudflare.com and nick.ns.cloudflare.com. The site presents an HTTP 200 response and serves an SSL certificate issued by Google Trust Services under the WE1 root, indicating proper TLS termination. Detected technologies include HSTS, Cloudflare CDN, and HTTP/3 support. The page title “SushiSwap V2: The Next Generation Decentralized Exchange (DEX)” and the explicit brand target SushiSwap identify the site as a brand‑impersonation effort aimed at crypto users. Google Safe Browsing classifies the URL as a SOCIAL_ENGINEERING threat, and PhishDestroy has already blocked it. VirusTotal reports that 7 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. Independent reputation services assign extremely low scores (Gridinsoft 0/100, Scamadviser 1/100) and the domain appears on one known security blocklist. Given the combination of a recent registration, Cloudflare‑hosted infrastructure, low reputation scores, and explicit brand impersonation, the domain should be treated as a high‑risk crypto‑scam vector. Defenders should add the domain and its resolved IP to blocklists, monitor DNS queries for the associated nameservers, and enforce web‑filtering policies that block URLs flagged by Google Safe Browsing. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any evolving payloads. The current evidence does not reveal a payload or malicious script, so further traffic analysis is required to determine the exact attack vector.