sushi-com[.]my

On July 24 2026 analysts observed the domain sushi-com.my was taken offline after being blocked by PhishDestroy. The domain was registered through DYNADOT LLC on 21 February 2026 and points to a Cloudflare edge IP 104.21.20.15 located in the United States under ASN 13335. The authoritative name servers are apollo.ns.cloudflare.com and meera.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and CDN services. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid‑looking HTTPS connection.

The single page that was reachable returned the title “Nur einen Moment…”, but no further content has been captured. The site is classified as a crypto‑scam that impersonates the decentralized exchange SushiSwap, matching the brand target listed in the intelligence. VirusTotal scans show three of ninety‑five security vendors flagged the domain, and it is listed on one external blocklist. No additional public threat‑intel feeds such as OTX or Google Safe Browsing were referenced in the available data.

Because the infrastructure relies on Cloudflare, takedown requests must be directed to the registrar and Cloudflare’s abuse channel. Defenders should add sushi-com.my to local blocklists, monitor for any re‑registration or similar domains using the same nameservers, and enforce endpoint controls that block connections to the IP 104.21.20.15. Continuous observation of the Cloudflare‑associated ASN and periodic re‑scanning with VirusTotal are recommended to detect any resurgence. At present the domain is offline, but the underlying technique—leveraging reputable TLS certificates and Cloudflare hosting to lend legitimacy to a brand‑impersonation crypto scam—remains a risk vector for future campaigns.