auth-sushiswap-tradee-en-us[.]pages[.]dev

The domain auth-sushiswap-tradee-en-us.pages.dev is actively involved in a high-risk brand impersonation campaign targeting the decentralized cryptocurrency trading platform SushiSwap. The domain is designed to mimic the legitimate services provided by SushiSwap, potentially luring users into disclosing sensitive information or facilitating unauthorized transactions. No specific drainer kit has been identified in this instance; however, the threat's nature suggests possible attempts at credential harvesting or transaction manipulation.

Technical analysis of this domain reveals that it has been flagged by 3 out of 95 security vendors on VirusTotal, indicating a moderate level of detection among security systems. The domain resolves to the IP address 172.66.44.93 and is registered through Cloudflare, Inc. It was created on October 17, 2025, which raises questions about the timeline of its detection and current activities. The domain's SSL certificate is issued by Google Trust Services / WE1, lending it a veneer of legitimacy. Despite these measures, it is listed on one security blocklist, further confirming its malicious intent.

Currently, the domain remains active, posing a persistent threat to users who may inadvertently engage with it. Immediate response actions should include reporting the domain to relevant authorities and security vendors to increase its detection rate. Users are advised to exercise extreme caution and verify the authenticity of URLs before providing any personal or financial information. The risk remains high as the domain continues to operate, necessitating ongoing vigilance and enhanced security measures to prevent potential exploitation.