acces-sushiswape-exchnge[.]pages[.]dev

PhishDestroy identifies active brand impersonation targeting SushiSwap via the fraudulent domain acces-sushiswape-exchnge.pages.dev. This threat leverages SushiSwap’s trusted branding to deceive users into connecting crypto wallets and approving malicious transactions. The infrastructure is hosted behind Cloudflare Pages, indicating a deliberate attempt to evade detection by leveraging legitimate service providers. At the time of analysis, VirusTotal shows 1/95 security engines have flagged this domain, suggesting minimal detection across major scanning platforms. This domain resolves to IP address 188.114.96.3 and is secured with a Google Trust Services SSL certificate, which may help it appear legitimate. Registered through Cloudflare, Inc., it operates under the .pages.dev TLD—a common choice for phishing campaigns due to its association with legitimate development platforms. Despite the lack of VirusTotal detections, the domain’s naming pattern (sushiswape) closely mimics SushiSwap (sushiswap), indicating a high intent to deceive users familiar with the DeFi protocol. No evidence of inclusion on public blocklists or threat intelligence feeds was observed at this stage, but this may change as reporting increases. To mitigate exposure to this threat, users should verify any website claiming to be SushiSwap by checking the official domain (sushi.com) or verified links from trusted sources. Never connect your wallet or enter credentials on unfamiliar domains. Block the IP 188.114.96.3 and domain acces-sushiswape-exchnge.pages.dev at the network level if possible. Report this domain to SushiSwap’s security team and update personal blocklists to prevent future exposure. Exercise extreme caution with any unsolicited links referencing SushiSwap, especially those hosted on .pages.dev domains.