steth[.]sushi-com[.]bond

Analysis of steth.sushi-com.bond indicates a deliberate brand impersonation campaign targeting SushiSwap users. The domain was registered on October 21, 2025 through Dynadot LLC and is hosted on IP address 142.251.140.164, which belongs to AS15169 Google LLC in the United States. No TLS certificate is presented, leaving the connection unencrypted. The site resolves to Cloudflare nameservers apollo.ns.cloudflare.com and meera.ns.cloudflare.com, suggesting the operator leveraged a widely trusted DNS provider to mask infrastructure. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent.

The page title returned by the server is "Google," which does not align with the claimed SushiSwap brand and may be an attempt to evade content‑based detection. VirusTotal records a single positive detection out of 95 scanned engines, confirming at least one vendor identified the domain as malicious. The domain appears on one security blocklist and has been actively blocked by PhishDestroy, indicating that threat‑intel feeds have already flagged the indicator. Current status shows the site is offline, but the underlying registration and hosting details remain valid and could be reactivated.

Defenders should immediately add steth.sushi-com.bond to domain blocklists across DNS, proxy, and endpoint security solutions. Continuous monitoring of the associated IP address and Cloudflare nameservers is advised, as they may be reused for future campaigns. Organizations that interact with SushiSwap should educate users about unsolicited links and enforce multi‑factor authentication to mitigate credential compromise. Given the low trust score, lack of TLS, and the positive vendor detection, the domain should be treated as a high‑risk indicator until the associated infrastructure is fully retired.