cake-sushi[.]cfd

On 23 July 2026, the domain cake-sushi.cfd was observed hosting a crypto‑related impersonation page targeting SushiSwap. The site was registered on 21 February 2026 and, at the time of analysis, had been taken offline. DNS resolution points to the IPv6 address 2606:4700:3034::ac43:88df, which belongs to AS13335, Cloudflare, Inc., located in the United States. The SSL certificate presented the identifier “WE1”, indicating a publicly‑trusted certificate rather than a self‑signed or expired token.

VirusTotal recorded two positive detections out of ninety‑three scanners, confirming that at least a minority of security engines flagged the domain as malicious. Independent blocklist services—including PhishDestroy, Polkadot, Enkrypt, and Codeesura—have all listed the domain, and the domain appears on four additional security blocklists, reinforcing the assessment of malicious intent. The page title returned “Un instant…”, a non‑English phrase that does not correspond to official SushiSwap branding and suggests a hastily assembled landing page. The available evidence classifies the activity as a crypto scam employing brand impersonation of SushiSwap.

Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms, as no page content beyond the title has been captured. Defenders should ensure that network‑level filters block the IPv6 address and add cake-sushi.cfd to URL filtering policies. Continuous monitoring of Cloudflare‑hosted infrastructure for similar impersonation attempts is recommended, as the provider’s flexible address allocation can facilitate rapid re‑deployment of malicious sites.