learn-us-sushiswap[.]pages[.]dev

This domain, learn-us-sushiswap.pages.dev, is actively impersonating SushiSwap, a decentralized finance (DeFi) platform, as indicated by its page title and confirmed brand target. Registered on November 4, 2025, through Cloudflare, Inc., the domain resolves to IP 172.66.47.3 (AS13335, Cloudflare, Inc.) and remains operational with an HTTP 200 status. The site employs HSTS and HTTP/3, leveraging Cloudflare's infrastructure, which is consistent with tactics used to evade detection and enhance perceived legitimacy. The SSL certificate is issued by WE1, a provider commonly used in both legitimate and malicious contexts. As of July 12, 2026, the domain appears on one security blocklist (PhishDestroy) and is flagged by 7 of 94 security vendors on VirusTotal, suggesting moderate but not universal detection. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. Defenders should treat this domain as a confirmed brand impersonation threat targeting SushiSwap users, likely designed to harvest credentials, private keys, or facilitate fraudulent transactions. Immediate action is recommended, including blocking the domain at the DNS or proxy level, monitoring for related subdomains or IPs, and alerting users to the impersonation risk. The exact content and functionality of the site remain unanalyzed, so additional indicators or payloads may emerge upon further inspection.