sca[.]sushiswap[.]lol

The domain sca.sushiswap.lol has been identified as a brand-impersonation threat specifically targeting SushiSwap, a decentralized finance protocol. Analysis confirms this domain was designed to deceive users into disclosing sensitive credentials, such as wallet private keys or recovery phrases, under the pretense of legitimate platform interaction. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered on September 16, 2025, through Dynadot LLC, a registrar commonly observed in phishing campaigns. It resolves to the IP address 172.67.145.250, which has been associated with other suspicious domains. Detection metrics indicate the domain was flagged by 2 of 95 security vendors on VirusTotal, while appearing on one security blocklist. The page title 'Just a moment...' suggests the use of evasion techniques, such as Cloudflare or similar proxy services, to obscure malicious intent and delay detection. At present, sca.sushiswap.lol is offline, reducing immediate risk to users. However, the domain's infrastructure and registration details remain indicators of compromise. Users who interacted with this domain prior to its takedown are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Proactive monitoring of newly registered domains impersonating DeFi platforms is recommended to mitigate similar threats.