nearprotocol[.]sushi[.]onl

Analysis of the domain nearprotocol.sushi.onl confirms its classification as a crypto scam targeting SushiSwap users, with elevated risk indicators despite its current offline status. The domain was registered on February 21, 2026, through an undisclosed registrar, and resolved to the IP address 142.250.186.36, which is allocated to Google LLC (AS15169) in the United States. The SSL certificate is identified as WE2, a detail that may assist in tracking related infrastructure. Detection data reveals limited but actionable intelligence: one of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on a single security blocklist.

PhishDestroy has explicitly blocked this domain, reinforcing its classification as a phishing threat. The Gridinsoft trust score of 0/100 further corroborates its high-risk status. The page title, 'Google,' does not align with the expected branding of SushiSwap, suggesting either misdirection or an incomplete or obfuscated phishing kit deployment. While the domain is currently offline, the available evidence—including its registration date, hosting on Google infrastructure, and detection by security vendors—indicates it was actively used in a brand impersonation campaign.

Defenders should treat this domain as confirmed malicious and prioritize monitoring for related infrastructure, particularly domains sharing the same SSL certificate or resolving to the same IP range. Given the targeting of SushiSwap, a decentralized finance platform, the campaign likely aimed to deceive users into disclosing wallet credentials or transferring cryptocurrency. No further details about the exact phishing mechanism or payload are available at this time, as the site content has not been analyzed. Organizations should update blocklists and alert users to the risk associated with this domain and similar impersonation attempts.