moodeng-sushi[.]cfd

The domain moodeng-sushi.cfd was registered on 21 February 2026 and is presently taken offline, but forensic traces indicate it was used to host a crypto‑related scam targeting SushiSwap users. The site presented a page titled "Stake SUSHI | Sushi", a phrasing that aligns with the brand target SushiSwap and suggests an attempt to lure victims into staking or delegating SUSHI tokens. Infrastructure analysis reveals that the domain resolves to IP address 107.172.83.150, hosted in the United States under ASN 36352, which is owned by HostPapa. The TLS certificate associated with the host is identified as "R11", offering no indication of extended validation or brand authenticity.

Reputation services assign extremely low confidence scores: Gridinsoft rates the domain 0 out of 100, while Scamadviser assigns a trust score of 16 out of 100, both reflecting a high probability of malicious intent. The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among threat‑intelligence feeds that the site is abusive. VirusTotal scans show that a single vendor out of ninety‑three flagged the domain, providing limited but corroborating evidence of malicious behavior. No safe‑browsing or Open Threat Exchange (OTX) entries are available, and the registrar details are not disclosed in the current intelligence set.

Given the elevated risk rating, security teams should add moodeng-sushi.cfd to firewall and DNS sinkhole rules, monitor for any residual traffic to its IP address, and block any outbound connections from internal assets to this host. Analysts should also watch for newly registered domains that reuse the "sushi" keyword or mimic the same page title, as threat actors often replicate successful lures. Continuous re‑evaluation is advised if the domain resurfaces or if additional detection signatures emerge.