sushi[.]cx

This domain, sushi.cx, is flagged as a high-risk brand impersonation site targeting SushiSwap, a decentralized cryptocurrency exchange. The domain was registered on March 1, 2026, through CentralNic Ltd and remains active as of July 12, 2026. It resolves to the IP address 172.67.211.52, which is associated with Cloudflare's infrastructure, and uses HTTP/3 and Vue.js technologies. The SSL certificate is issued by Google Trust Services. The page title is 'Swap | Sushi 🍣', which directly mimics the legitimate SushiSwap interface. VirusTotal shows 2 of 95 security vendors flagging the domain, and it appears on two security blocklists, including PhishDestroy and BLP-Malware. AlienVault OTX reports the domain in 23 threat intelligence pulses, and Gridinsoft gives it a trust score of 0/100, indicating high suspicion. Defenders should block the domain and IP 172.67.211.52 at network and email gateways, monitor for related subdomains or infrastructure, and alert users to avoid interacting with the site. The exact phishing mechanism (e.g., credential harvesting or crypto wallet drainer) is not yet confirmed, but the combination of brand impersonation, low trust score, and blocklist presence warrants immediate action.