treade-with-sushiswap[.]pages[.]dev

This domain is currently under investigation for brand impersonation, specifically targeting SushiSwap, a decentralized finance platform. The threat type involves fraudulent replication of the legitimate service to deceive users into interacting with malicious infrastructure, likely for credential harvesting or unauthorized fund transfers. Analysis indicates the domain is designed to mimic SushiSwap’s trading interface, including references to spot trading, perpetual contracts, and lending services in its page title. Infrastructure analysis reveals the domain treade-with-sushiswap.pages.dev was registered on October 16, 2025, through Cloudflare, Inc., and resolves to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare’s network (AS13335). VirusTotal reports zero detections across 95 security engines, suggesting the domain has not yet been widely flagged. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. The domain appears on one security blocklist, indicating preliminary detection by at least one threat intelligence source. No prior reputation or historical activity was identified, increasing the likelihood of a recently deployed phishing operation. Mitigation steps for this threat type include immediate blocking of the domain at the network level, particularly for endpoints accessing decentralized finance services. Organizations should monitor for connections to the IPv6 address 2a06:98c1:3121::3 and the domain’s Cloudflare-hosted infrastructure. Users should be educated to verify the authenticity of SushiSwap-related domains by cross-referencing official communications and checking for subtle misspellings or unusual subdomains. Additionally, security teams should inspect SSL certificates for anomalies, such as unexpected issuers or short validity periods, and correlate domain registration dates with known phishing campaigns targeting the brand.