usr-sushi[.]cfd

Analysis of the domain usr-sushi.cfd indicates it was created on February 21, 2026, and is assessed as a brand impersonation threat targeting SushiSwap, a decentralized cryptocurrency exchange. The domain resolved to IP address 104.21.16.223, hosted on Cloudflare infrastructure (AS13335) in the United States. At the time of this report, the domain is offline, though it was previously flagged by four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, which classify it as a crypto scam.

Two of 93 security vendors on VirusTotal detected malicious indicators associated with this domain. The SSL certificate is issued under the identifier WE1, and the only known page title recorded was in Hebrew: 'רק רגע...' (translating to 'Just a moment...'), which may suggest a holding page or redirect mechanism, though the exact content and functionality of the site remain unconfirmed due to its offline status. No evidence links this domain to legitimate SushiSwap infrastructure or official partnerships.

Defenders are advised to block the domain and its associated IP at perimeter security controls, monitor for related subdomains or typosquatting variants, and alert users who may have interacted with the site prior to its takedown. While the domain is no longer accessible, historical exposure or cached instances may still pose residual risk.