faq-trade-sushiswapp[.]pages[.]dev

The domain faq-trade-sushiswapp.pages.dev was registered on October 15, 2025 and is currently active. It resolves to the IP address 172.66.47.170, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a page titled "Sushiswap® Trade Guide | Login, Account Recovery & Troubleshooting" and is explicitly listed as impersonating the SushiSwap brand, aligning with a cryptocurrency‑related scam profile. The risk rating is high, and the domain appears on one security blocklist.

Infrastructure analysis shows the domain is hosted behind Cloudflare’s edge network, using the nameservers diana.ns.cloudflare.com and javon.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 label, and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3. An HTTP request returns a 200 status code, indicating the page is reachable and serving content. The domain’s registration is listed under Cloudflare, Inc., confirming the use of a privacy‑preserving registrar.

Threat intelligence sources report that only one of ninety‑five VirusTotal scanners flagged the domain, while Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The site is already blocked by the PhishDestroy blocklist, and its page title directly references SushiSwap, confirming the brand‑impersonation intent. No additional page content has been examined, so the exact tactics used to harvest credentials or lure victims remain unverified.

Defenders should immediately add faq-trade-sushiswapp.pages.dev to URL filtering and DNS block lists, monitor for any outbound connections to the associated Cloudflare IP, and enforce strict email and web gateway policies that flag references to SushiSwap. Continuous observation of the domain’s DNS records and any changes to its TLS configuration is recommended, as threat actors often shift infrastructure while retaining the same domain registration.