sushiswapes[.]pages[.]dev

PhishDestroy identifies an active brand impersonation campaign impersonating SushiSwap delivered through the domain sushiswapes.pages.dev. This malicious site is designed to trick users into surrendering cryptocurrency wallet credentials or private keys under the guise of a legitimate SushiSwap interface. The threat becomes more dangerous because no antivirus or security vendor has yet flagged the domain according to VirusTotal’s latest scan, giving it a false cloak of legitimacy despite its malicious intent. This domain was flagged using confirmed indicators from VirusTotal where 1 out of 95 security engines detected the malicious nature as of the latest report. The domain resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services for an SSL certificate. Cloudflare’s infrastructure is often abused in these campaigns due to its fast provisioning and anonymity protections. The use of a *.pages.dev subdomain adds a veneer of credibility via legitimate developer hosting, making the phishing page appear more authentic to potential victims. If you visited sushiswapes.pages.dev, cease interaction immediately with the site and do not input any wallet passwords, seed phrases, or private keys. Disconnect from the site and clear browser cache. Scan your system using updated antivirus software and consider revoking any credentials exposed to this domain. Report this domain to SushiSwap’s official security channels and share with your security team for network monitoring. Monitor your blockchain wallets for unauthorized transactions and enable transaction alerts through your wallet provider.