sxt-sushi[.]cfd

This domain, sxt-sushi.cfd, was registered on August 18, 2025 through Namecheap and currently resolves to the Cloudflare address 172.67.128.36 (AS13335, United States). The site presents a generic page title “Just a moment…”, which offers no legitimate content and is commonly used by malicious actors to delay analysis. Reputation services assign a Gridinsoft score of 0 / 100 and a Scamadviser score of 45 / 100, indicating very low credibility. VirusTotal reports that 2 of 93 security vendors have flagged the domain, confirming the presence of malicious indicators.

The domain appears on four public blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing the classification as a crypto‑related scam. The SSL certificate is identified only as “WE1”, a designation that typically reflects a weak or untrusted certificate. The threat profile lists the impersonated brand as SushiSwap and categorises the activity as a crypto scam. The domain is presently offline, but historical activity suggests it was used to lure victims into fraudulent SushiSwap‑related interactions.

At this time, no active payload or phishing page has been captured, so the exact malicious behavior remains unconfirmed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future re‑registration or use of similar naming patterns, and enforce strict verification of SushiSwap communications. Additional scrutiny of outbound traffic to Cloudflare‑hosted IPs that resolve to newly created domains with low trust scores is advised. Correlation with other observed crypto‑scam campaigns may reveal shared infrastructure.