sushiswap-sushi-swap[.]cc

Analysis of sushiswap-sushi-swap.cc indicates a confirmed brand impersonation targeting SushiSwap, a decentralized cryptocurrency exchange. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and is currently offline. Infrastructure analysis reveals the domain resolves to IP address 172.67.214.170, hosted by Cloudflare in Canada, with nameservers audrey.ns.cloudflare.com and augustus.ns.cloudflare.com. The page title, www.www.sushiswap-sushi-swap.cc, exhibits irregular formatting, a common tactic in phishing domains to create a false sense of legitimacy or confuse users.

Five of 93 security vendors on VirusTotal flagged this domain as malicious, aligning with its presence on the PhishDestroy blocklist, which classifies it as a crypto scam. The domain's creation date, combined with its rapid detection by security vendors, suggests a short-lived but targeted campaign. While the exact content of the site remains unanalyzed due to its offline status, the available evidence—including the domain name structure, blocklist classification, and vendor detections—strongly supports its role in a cryptocurrency-related scam. Defenders should treat this domain as a high-confidence threat.

Network-level blocks at the IP and domain level are recommended, along with monitoring for related infrastructure, such as similarly named domains or shared hosting patterns. Given Cloudflare's frequent use by threat actors to obscure origins, additional scrutiny of domains using the same nameservers or IP range may uncover further malicious activity. No SSL or HTTP status details are available, and further forensic analysis would require access to historical snapshots or logs.