sushi-swap[.]org

This domain is classified as a high-risk brand impersonation threat targeting decentralized finance (DeFi) users. Analysis indicates sushi-swap.org specifically mimics SushiSwap, a popular decentralized exchange (DEX), to execute credential harvesting attacks and unauthorized cryptocurrency wallet access. The threat type aligns with known patterns of DeFi phishing, where attackers replicate legitimate interfaces to trick users into disclosing private keys or approving malicious smart contracts. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain resolves to IP address 91.92.243.31 (AS202412 Omegatech LTD, Netherlands), a hosting provider frequently associated with phishing infrastructure. Registered through Porkbun LLC on December 11, 2025, the domain uses a Let's Encrypt SSL certificate (serial E7), providing a false sense of security. Detection metrics show 18 out of 95 security vendors on VirusTotal flag the domain as malicious. Five security blocklists—PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB—have actively blocked this domain. The page title 'Sushi Swap | DEX' further confirms the impersonation attempt, matching the branding of the legitimate SushiSwap platform. Mitigation requires immediate action from both users and security teams. Users who interacted with sushi-swap.org should revoke all active smart contract approvals via blockchain explorers and transfer assets to new wallets. Security teams should add the domain, IP 91.92.243.31, and associated SSL certificate (E7) to network blocklists and endpoint protection rules. Organizations should monitor for credential reuse attempts from affected users and implement phishing-resistant authentication methods for DeFi access. Given the domain's current offline status, continuous monitoring for re-emergence under similar naming conventions (e.g., sushi-swap-app.org, sushiswap-secure.org) is recommended.