kibshi[.]sushis[.]dev

This domain, kibshi.sushis.dev, is flagged as a brand impersonation threat targeting SushiSwap, a decentralized cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into interacting with fraudulent interfaces, likely aiming to harvest credentials or facilitate unauthorized transactions. The page title 'Just a moment...' suggests the use of anti-bot or proxy-based obfuscation techniques, commonly employed to evade detection during initial scans or automated crawls.

Infrastructure analysis reveals the following technical indicators: the domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It has been flagged by 3 out of 95 security vendors on VirusTotal, indicating partial but not universal detection. The domain appears on at least one security blocklist, and its current status is offline. No creation date is available in the provided data, but the use of Cloudflare infrastructure aligns with common phishing tactics to obscure hosting origins and leverage CDN-based protections.

At present, kibshi.sushis.dev has been taken offline, likely due to hosting provider intervention or domain suspension. However, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this infrastructure, particularly those involving SushiSwap or similar cryptocurrency platforms. Blocking the IP address 188.114.96.3 at the network level and updating endpoint protection rules to include this domain are recommended mitigations. Continued vigilance is warranted, as threat actors may re-establish similar infrastructure under new domains or IPs.