aiozsushi[.]top

Analysis indicates that aiozsushi.top is an active brand-impersonation domain created on May 18, 2026, targeting users of the decentralized exchange SushiSwap. Infrastructure analysis reveals the domain is hosted behind Cloudflare nameservers (buck.ns.cloudflare.com and emily.ns.cloudflare.com) and resolves to 104.21.70.115, an anycast IP registered to Cloudflare, Inc. in Canada. The domain is registered through Dynadot LLC and uses a Let's Encrypt SSL certificate with serial number prefix E8, a configuration consistent with many phishing sites leveraging free certificates for apparent legitimacy. The domain is currently flagged by three security blocklists, including MetaMask and SEAL, and appears in one AlienVault OTX threat intelligence pulse. The HTTP response returns a 302 redirect, and the page title is reported as 'Google', which may indicate an attempt to evade detection or serve cloaked content. While the domain is classified as a brand impersonation scam, the exact mechanics of the fraud—such as whether it employs a crypto drainer, fake wallet connector, or other deception—remain unconfirmed due to lack of direct page analysis. Defenders are advised to block the domain at the DNS or network level, monitor for connections to 104.21.70.115, and alert users to avoid interacting with any site claiming affiliation with SushiSwap under this domain. The use of Cloudflare infrastructure, while common among legitimate services, is frequently exploited by threat actors to mask origin servers and complicate takedown efforts. Given the domain's persistence and active blocklist presence, it is assessed as a high-risk threat.