sxt[.]sushiswap[.]art

This domain is flagged for elevated-risk brand impersonation targeting SushiSwap, a decentralized finance platform. The threat involves deceptive infrastructure designed to mimic legitimate SushiSwap interfaces, likely to harvest credentials, private keys, or facilitate unauthorized transactions. Analysis indicates the domain was structured to exploit trust in the SushiSwap brand, potentially tricking users into interacting with malicious smart contracts or disclosing sensitive wallet information. Infrastructure analysis reveals the domain sxt.sushiswap.art was registered on September 16, 2025, through Dynadot LLC. It resolved to the IP address 188.114.96.3 and displayed a page title of 'Just a moment...', a common indicator of cloaking or redirect behavior. VirusTotal reports 2 out of 95 security vendors flagged the domain as malicious. The domain appears on one security blocklist and was actively blocked by at least one threat intelligence feed. No additional subdomains or associated certificates were observed at the time of analysis. Mitigation steps for this threat type include immediate blacklisting of the domain and IP across all network security controls. Organizations should update endpoint detection rules to flag interactions with sxt.sushiswap.art or its resolved IP. Users who may have interacted with the domain should revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Security teams are advised to review logs for connections to 188.114.96.3 or related infrastructure. Given the brand impersonation tactic, awareness campaigns should emphasize verifying domain authenticity before interacting with DeFi platforms.