sushipswap[.]eu

PhishDestroy identifies sushipswap.eu as an active brand impersonation site targeting SushiSwap users. This domain operates as a cryptocurrency drainer designed to mimic the legitimate SushiSwap platform, harvesting credentials and digital assets from unsuspecting visitors. The site masquerades under a visually similar domain name to deceive users into connecting wallets or entering sensitive information, posing a direct threat to cryptocurrency holders.

This domain was flagged with a VirusTotal detection score of 3/95, indicating no current antivirus or security engine has flagged it as malicious. The domain is registered through IMMATERIALISM LIMITED and resolves to IP address 185.114.96.3. The SSL certificate, issued by Let's Encrypt, adds a veneer of legitimacy, further deceiving potential victims. There is no known specific drainer kit identified at this time, but the site's behavior aligns with common crypto-draining tactics observed in similar campaigns.

The domain remains active and under investigation with a current risk level marked as active. Immediate actions include blocking the domain at the network and DNS levels, reporting the site to relevant authorities such as Google Safe Browsing and local cybercrime units, and alerting the cryptocurrency community. While the immediate risk is elevated due to inaction by antivirus engines, the lack of detections suggests a potential window of opportunity for threat actors. Users should exercise extreme caution, verify URLs meticulously, and avoid interacting with this domain or any associated links.