merl-sushi[.]cfd

The domain merl-sushi.cfd is an active brand impersonation threat specifically targeting SushiSwap, a decentralized cryptocurrency exchange. This phishing domain mimics SushiSwap's interface to trick users into connecting their cryptocurrency wallets or entering sensitive information. Once a user interacts, attackers can drain funds or steal credentials, posing a direct financial risk.

PhishDestroy's analysis reveals that merl-sushi.cfd appears on 4 security blocklists and has been flagged by 3 out of 95 security vendors on VirusTotal, indicating moderate but significant detection. The domain was created on February 21, 2026, and uses an SSL certificate issued by WE1, which is not a widely trusted certificate authority. It resolves to the IP address 2606:4700:3032::ac43:d2cb, associated with Cloudflare, a common hosting provider used by malicious actors to obscure their origin. The page title "Nur einen Moment…" is a German phrase meaning "Just a moment…" and is often used in phishing pages to simulate loading screens.

Users who have visited merl-sushi.cfd should immediately disconnect any cryptocurrency wallets that were connected and revoke permissions via a trusted platform like Etherscan or a wallet manager. It is also advised to run a security scan on their device and monitor accounts for unauthorized transactions. To stay safe, always verify the official SushiSwap URL (sushi.com) and avoid interacting with unsolicited links. PhishDestroy recommends reporting the domain to security vendors for blocklist updates.