Analysis of the domain sushii-swaps.org indicates it is an active phishing site targeting users of cryptocurrency swap platforms. Registered on July 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain currently resolves to IP address 104.21.85.151, hosted on Cloudflare nameservers ariella.ns.cloudflare.com and wilson.ns.cloudflare.com. As of August 1, 2026, the domain appears on two security blocklists, PhishDestroy and ScamSniffer, though it remains unflagged by the 91 vendors that scanned it on VirusTotal. The absence of detections does not confirm safety, particularly given the domain's recent registration and presence on multiple blocklists.
Infrastructure analysis reveals the use of Cloudflare, a common tactic to obscure hosting details and evade IP-based blocking. The domain's creation date suggests it is part of a recent campaign, with defenders advised to monitor for additional domains registered through the same registrar or resolving to the same IP. While the exact content of the site has not been analyzed, the domain name implies an attempt to impersonate a legitimate cryptocurrency swap service, a known phishing vector for credential theft or wallet drainage.
Defenders should treat this domain as suspicious based on its blocklist status and recent registration, despite the lack of vendor detections. Proactive blocking at the DNS or network level is recommended, alongside monitoring for related domains using similar naming conventions or infrastructure. Further investigation into the domain's content and associated wallet addresses is advised to determine the full scope of the campaign.